diff --git a/SECURITY.md b/SECURITY.md index 4a18be93..5c5287e0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,41 +4,151 @@ We provide security updates for the following versions of Stalwart: -| Version | Supported | -| ------- | ------------------ | -| 0.12.x | :white_check_mark: | -| 0.11.x | :white_check_mark: | -| < 0.10 | :x: | +| Version | Supported | End of Support | +| ------- | ------------------ | -------------- | +| 0.12.x | :white_check_mark: | TBD | +| 0.11.x | :white_check_mark: | 2025-12-31 | +| < 0.11 | :x: | Ended | + +**Note**: We typically support the current major version and one previous major version. Users are strongly encouraged to upgrade to the latest version for the best security posture. ## Reporting a Vulnerability -We take the security of Stalwart very seriously. If you believe you've found a security vulnerability, we encourage you to inform us responsibly. +We take the security of Stalwart very seriously. If you believe you've found a security vulnerability, we encourage you to inform us responsibly through coordinated disclosure. -**Do not report security vulnerabilities through public GitHub issues.** +### How to Report -Instead, please send an email to us at hello@stalw.art (do not use this email for support questions). You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. +**Do not report security vulnerabilities through public GitHub issues, discussions, or social media.** -To help us better understand the nature and scope of the potential issue, please describe as much as you can about the vulnerability: +Instead, please use one of these secure channels: -- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) -- Full paths of source file(s) related to the manifestation of the issue -- The location of the affected source code (tag/branch/commit or direct URL) -- Any special configuration required to reproduce the issue -- Step-by-step instructions to reproduce the issue -- Proof-of-concept or exploit code -- Impact of the issue, including how an attacker might exploit the issue +1. **Email** (preferred): Send details to `security@stalw.art` +2. **GitHub Security Advisories**: Use the "Report a vulnerability" button in the Security tab +3. **Backup contact**: If no response within 48 hours, email `hello@stalw.art` -This information will help us triage your report more quickly. +### What to Include -Our security team will acknowledge your email within 24 hours, and you'll receive a more detailed response to your email within 48 hours indicating the next steps in handling your report. +To help us understand and address the issue quickly, please include: -## Policy +**Required Information:** +- Brief description of the vulnerability type +- Affected version(s) and components +- Steps to reproduce the issue +- Impact assessment (what could an attacker achieve?) -If you follow these guidelines when reporting an issue to us: +**Helpful Additional Details:** +- Full paths of affected source files +- Specific commit/branch where the issue exists +- Required configuration to reproduce +- Proof-of-concept code (if available) +- Suggested mitigation or fix (if you have ideas) -- We will acknowledge your report & provide an estimated timeframe for a fix. -- We will notify you when the issue is resolved. -- We will not take legal action against or suspend or terminate your access to the project. +### Our Response Process -We strive to keep all our users safe and will make our best effort to promptly fix any security issue. +**Timeline Commitments:** +- **Initial acknowledgment**: Within 24 hours +- **Detailed response**: Within 72 hours +- **Status updates**: Every 7 days until resolved +- **Resolution target**: 90 days for most issues + +**What We'll Do:** +1. Acknowledge your report and assign a tracking ID +2. Assess the vulnerability and determine severity +3. Develop and test a fix +4. Coordinate disclosure timeline with you +5. Release security update and publish advisory +6. Credit you in our security advisory (if desired) + +## Disclosure Policy + +We follow responsible disclosure principles: + +- **Coordinated disclosure**: We'll work with you to determine appropriate disclosure timing +- **Typical timeline**: 90 days from report to public disclosure +- **Early disclosure**: May occur if issue is being actively exploited +- **Delayed disclosure**: May be necessary for complex issues requiring significant changes + +## Scope + +This security policy applies to: + +**In Scope:** +- Stalwart (all supported versions) +- Official Docker images +- Documentation that could lead to insecure configurations +- Dependencies with security implications + +**Out of Scope:** +- Third-party integrations or plugins +- Issues requiring physical access to the server +- Social engineering attacks +- Attacks requiring compromised credentials (unless the vulnerability enables credential compromise) +- Theoretical vulnerabilities without practical exploitation + +## Security Measures + +**Our Commitments:** +- Regular security audits of dependencies using `cargo audit` +- Automated security scanning in CI/CD pipeline +- Following Rust security best practices +- Prompt security updates for critical dependencies +- Security-focused code review process + +**User Responsibilities:** +- Keep Stalwart updated to supported versions +- Follow security configuration guidelines +- Implement proper network security (firewalls, TLS, etc.) +- Regular security monitoring and logging +- Secure credential management + +## Legal Safe Harbor + +We support security research conducted in good faith. If you follow these guidelines: + +**We will NOT:** +- Initiate legal action against you +- Contact law enforcement about your research +- Suspend or terminate your access to Stalwart services + +**You must:** +- Only test against your own Stalwart installations +- Not access, modify, or delete user data +- Not perform testing that could degrade service availability +- Not publicly disclose the issue before coordinated disclosure +- Act in good faith and not for malicious purposes + +## Recognition + +We believe in recognizing security researchers who help keep Stalwart secure: + +- **Security Advisory Credits**: We'll credit you in our GitHub Security Advisories (unless you prefer to remain anonymous) +- **Hall of Fame**: Significant contributors may be listed in our security acknowledgments +- **Swag**: We may send Stalwart merchandise for notable contributions + +## Security Updates + +**Stay Informed:** +- Subscribe to our [GitHub releases](https://github.com/stalwartlabs/stalwart/releases) for security updates +- Join our community channels for security announcements +- Enable GitHub notifications for security advisories + +**Update Process:** +- Security updates are published as patch releases (e.g., 0.12.1 → 0.12.2) +- Critical vulnerabilities may receive out-of-band releases +- Docker images are updated simultaneously with releases +- Security advisories are published through GitHub Security Advisories + +## Contact Information + +- **Security reports**: security@stalw.art +- **General inquiries**: hello@stalw.art +- **PGP Key**: Available upon request for sensitive communications + +## Additional Resources + +- [Stalwart Security Incident Response Process](SECURITY_PROCESS.md) +- [Security Configuration Guide](https://stalw.art/docs/install/security) +- [Rust Security Advisory Database](https://rustsec.org/) + +*This security policy is effective as of June 20, 2025 and may be updated periodically. Check back regularly for updates.* diff --git a/SECURITY_PROCESS.md b/SECURITY_PROCESS.md new file mode 100644 index 00000000..ad7d2c89 --- /dev/null +++ b/SECURITY_PROCESS.md @@ -0,0 +1,173 @@ +# Stalwart Security Incident Response Checklist + +## Phase 1 : Initial Assessment & Validation + +### Updates + +<< Use this section to detail the report received, initial assessment, and validation results >> + +Example: + +I've reviewed the security report and confirmed this vulnerability exists in Stalwart version X.Y.Z. + +Assessment of exploitability: + +- Attack complexity: [High/Medium/Low] +- Prerequisites: [Authentication required/Network access/Specific configuration/etc.] +- User interaction required: [Yes/No] + +Potential impact: +- Email data confidentiality: [At risk/Not affected] +- Server integrity: [At risk/Not affected] +- Service availability: [At risk/Not affected] +- Estimated affected installations: [Number/Percentage] + +### Resources + +- [Stalwart Security Policy](https://github.com/stalwartlabs/stalwart/blob/main/SECURITY.mdy) +- [CVE Scoring Calculator](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator) +- [Rust Security Advisory Database](https://rustsec.org/) + +### Tasks + +- [ ] Reproduce the vulnerability in test environment +- [ ] Assess CVSS score and severity level +- [ ] Check if vulnerability affects current stable version +- [ ] Check if vulnerability affects LTS versions (if applicable) +- [ ] Determine if this requires immediate action or can wait for next release cycle +- [ ] Document technical details and root cause + +### Assessment Summary + +- **Severity Level**: `Critical|High|Medium|Low` +- **CVSS Score**: `X.X` +- **Affects versions**: `X.Y.Z to X.Y.Z` +- **Root cause**: Brief technical explanation +- **Introduced in commit/version**: `commit-hash` or `vX.Y.Z` +- **Attack vector**: `Network|Local|Physical` +- **Estimated timeline for fix**: `X days/weeks` + +## Phase 2: Immediate Response & Mitigation + +### Updates + +<< Document immediate actions taken and mitigation strategies >> + +Example: + +Working on hotfix for version X.Y.Z. Temporary workaround available by disabling [feature] in configuration. + +### Tasks + +- [ ] Implement immediate workaround if possible +- [ ] Update security advisory draft +- [ ] Prepare patch/hotfix +- [ ] Test fix thoroughly in development environment +- [ ] Prepare updated Docker images and binaries +- [ ] Draft security advisory for GitHub Security Advisories +- [ ] Consider if coordinated disclosure timeline needs adjustment + +### Mitigation Details + +- **Workaround available**: `Yes|No` - If yes, describe briefly +- **Fix implemented on**: `YYYY-MM-DD` +- **Patch/hotfix version**: `vX.Y.Z` +- **GitHub Security Advisory ID**: `GHSA-XXXX-XXXX-XXXX` + +## Phase 3: Impact Assessment & User Analysis + +### Updates + +<< Analysis of potential impact on the Stalwart deployments >> + +Based on telemetry data and version statistics, approximately X installations may be affected. + +### Tasks + +- [ ] Analyze version adoption from update checks (if available) +- [ ] Estimate number of vulnerable installations +- [ ] Assess if default configurations are vulnerable +- [ ] Review if vulnerability has been exploited (check logs, reports) +- [ ] Determine if any user data may have been compromised +- [ ] Check for indicators of active exploitation in the wild + +### Analysis Notes + +_Document your impact assessment process and findings_ + +### Impact Summary + +- **Estimated vulnerable installations**: `~X out of Y` +- **Default configuration vulnerable**: `Yes|No` +- **Evidence of exploitation**: `Found|Not found|Unknown` +- **User data potentially at risk**: `Email content|Credentials|Configuration|None` +- **Confidence in assessment**: `High|Medium|Low` + +## Phase 4: Communication & Release + +### Updates + +<< Communication strategy and release timeline >> + +Security release vX.Y.Z will be published on YYYY-MM-DD with coordinated disclosure. + +### Tasks + +**Pre-release preparation:** + +- [ ] Finalize security patch +- [ ] Prepare release notes with security details +- [ ] Update documentation if needed +- [ ] Test automated update mechanisms +- [ ] Prepare GitHub Security Advisory + +**Communication channels:** + +- [ ] Draft announcement for Stalwart community forum/Discord +- [ ] Prepare release announcement for GitHub +- [ ] Draft security advisory content +- [ ] Consider notification to major distributors/packagers + +**Release execution:** + +- [ ] Publish patched version to GitHub releases +- [ ] Update Docker images on Docker Hub +- [ ] Publish GitHub Security Advisory +- [ ] Post to community channels (Discord/forum) +- [ ] Update project website/documentation +- [ ] Submit CVE request if warranted (CVSS ≥ 4.0) + +**Post-release:** + +- [ ] Monitor community channels for questions +- [ ] Track adoption of security update +- [ ] Follow up on any additional reports +- [ ] Document lessons learned + +### Communication Record + +- **Security release published**: `YYYY-MM-DD HH:MM UTC` +- **GitHub Security Advisory**: `GHSA-XXXX-XXXX-XXXX` +- **CVE ID** (if applicable): `CVE-YYYY-XXXXX` +- **Community announcement**: [Link to forum/Discord post] +- **Estimated time to 50% adoption**: `X days/weeks` + +## Post-Incident Review + +### What went well? +- + +### What could be improved? +- + +### Action items for future incidents: +- [ ] +- [ ] +- [ ] + +### Process improvements: +- [ ] +- [ ] + +## Emergency Contacts +- **Primary maintainer**: hello@stalw.art