Security policy
The deployment threat model records trust boundaries, STRIDE risks and verification work for operators and contributors.
GuestCraft handles identity documents, payments and personal data of guests. Security reports are welcome and are handled privately.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Do not open a public issue, discussion or pull request for a vulnerability.
Report it through GitHub’s private vulnerability reporting, at https://github.com/Spinny03/guestcraft/security/advisories/new (the repository’s Security tab, Report a vulnerability). Only the maintainers and you can read the report. If you cannot use it, open an issue that asks for a private contact, without any detail of the vulnerability.
Please include what you found, how to reproduce it, the version or commit, and the impact you expect. Do not access, modify or keep data that is not yours while testing, and test only on installations you own.
What happens next
Section titled “What happens next”| Step | Target |
|---|---|
| Acknowledgement of the report | within 72 hours |
| First assessment, with severity (CVSS) | within 7 days |
| Fix and advisory | depends on severity; critical issues are prioritized over any other work |
The maintainers keep you informed, agree on a disclosure date with you, credit you in the advisory unless you prefer otherwise, and request a CVE when appropriate. These are targets, not guarantees: the project is maintained by a small team, and the GOVERNANCE.md file says who that is.
Supported versions
Section titled “Supported versions”Releases follow the release guide. Before 1.0, fixes ship as patch releases of the latest 0.x minor version only: upgrade to it to receive them. main also receives every fix. No version has been released yet, so today only main is supported. Until then, a build is identified by its commit ID. From 1.0, the policy of the technical analysis applies (chapter 17: latest minor, previous minor and a yearly LTS) and will be published here.
To check that an image is an official one, verify its attestation as the release guide shows.
Security design
Section titled “Security design”The secure-design principles, the countermeasures for common vulnerability classes and every use of cryptography are described in docs/architecture/security.md.
In scope: the code in this repository and the official container images and packages built from it. Out of scope: installations operated by third parties (contact their operator), Channex and the OTAs (report to them directly), and findings that require a compromised server or physical access to a device.