From af7cbf89b78de883c693bfa7c1e99fc5c2dfa648 Mon Sep 17 00:00:00 2001 From: Dani Date: Wed, 29 Jul 2026 23:17:43 -0400 Subject: [PATCH] docs(security): refresh supported versions and link published advisories The supported-versions section still said "released and at v1.0.0" and listed all of `1.x` as supported, which had drifted two minor releases. It is now stated as a line ("1.2.x (current)") rather than a pinned patch number, so it does not go stale on the next release. Also: - Point readers at /security/advisories, and tell them to read the affected range on the advisory rather than comparing version numbers. - Add a threat-model bullet for ingested documents. The loopback-only default covers who can call the API, but filenames, metadata, and content arriving from elsewhere are untrusted regardless of how the API is reached. - Note that reporters are credited in the advisory as well as the release notes, which is what we do in practice. Reporting stays email-only; GitHub private vulnerability reporting is deliberately left disabled so the documented 5-business-day response runs through one monitored inbox. Co-Authored-By: Claude Opus 5 (1M context) --- SECURITY.md | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 60f6e22e..e2be93fd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,13 +2,13 @@ ## Supported Versions -EverOS is released and at v1.0.0 (stable). Security fixes are applied to the -latest release line only. +Security fixes are applied to the latest release line only; older minor lines do +not receive backports. | Version | Supported | |---------|-----------| -| 1.x | ✅ | -| < 1.0 | ❌ | +| `1.2.x` (current) | ✅ | +| `1.1.x` and older | ❌ — upgrade to the current line | ## Reporting a Vulnerability @@ -24,8 +24,18 @@ Instead, email **evermind@shanda.com** with: We will acknowledge your report within **5 business days**, keep you informed of progress, and aim to ship a fix or mitigation before any public disclosure. -Reporters are credited in the release notes unless you prefer to remain -anonymous. +Reporters are credited in the advisory and the release notes unless you prefer +to remain anonymous. + +## Published Advisories + +Confirmed issues are published as GitHub Security Advisories, each carrying the +affected version ranges and the release that fixes them: + + + +To check whether an installation is affected by a past issue, read the version +range on the advisory itself — the range is authoritative. ## Scope & Threat Model @@ -39,6 +49,10 @@ following in mind: is loopback-only. Only set the bind to `0.0.0.0` (or any routable interface) after you have placed your own gateway / auth layer in front; `everos server start` will log a warning when you bind to `0.0.0.0`. +- **Documents you ingest are untrusted input.** Filenames, metadata, and + content that originate outside your control are parsed, indexed, and written + to disk. An instance that ingests third-party documents is processing + untrusted data even when the API itself is reachable only from loopback. - Secrets (LLM / embedding API keys) live in your local `.env`; protect that file as you would any credential. EverOS never transmits them anywhere except the providers you configure.