2.0 KiB
Security Policy
Joulenap can trigger backups and power machines on and off, and it holds Proxmox API tokens and an SSH key. We take security reports seriously and appreciate responsible disclosure.
Supported versions
Joulenap is pre-1.0 and moves fast; only the latest release line receives security fixes.
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
| < 0.1 | ❌ |
Reporting a vulnerability
Please do not open a public issue for security problems.
Report privately through GitHub's Report a vulnerability button (Security tab → Report a vulnerability). This opens a private advisory visible only to the maintainers.
Please include:
- affected version and how Joulenap is deployed (Docker / LXC / source),
- a description of the issue and its impact,
- steps to reproduce or a proof of concept,
- any relevant logs or config — with secrets redacted (tokens, SSH keys, bot tokens).
You can expect an acknowledgement within a few days. We'll work with you on a fix and coordinate disclosure; we're happy to credit you unless you'd prefer to stay anonymous.
Security model
Joulenap is designed to run on a trusted LAN/VPN, not on the public internet. Its posture:
- Scoped API tokens over root passwords for PVE and PBS. If root credentials are supplied during
setup, they're used transiently to provision a scoped token / install the SSH key, then discarded
— never written to
config.yaml. - The SSH key to PBS is generated by the app and, ideally, restricted to the poweroff command.
- The UI is login-protected; the session cookie is signed with a per-install random key.
- Secrets live only in
config.yaml(git-ignored) and never leave your server through the API (they're redacted in responses).
See the Security section of the README for operator guidance. If you find a gap between this model and the code, that's exactly the kind of report we want.