mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
58 lines
2.2 KiB
Markdown
58 lines
2.2 KiB
Markdown
|
# Security Policy
|
||
|
|
|
||
|
|
RoboCo is licensed under the GNU Affero General Public License v3.0
|
||
|
|
(AGPL-3.0). This policy explains which versions receive security fixes and how
|
||
|
|
to report a vulnerability responsibly.
|
||
|
|
|
||
|
|
## Supported Versions
|
||
|
|
|
||
|
|
RoboCo is pre-1.0 and ships as a Docker image / GitHub release rather than a
|
||
|
|
versioned library. Security fixes are applied to the latest release and the
|
||
|
|
`master` branch only.
|
||
|
|
|
||
|
|
| Version | Supported |
|
||
|
|
| ------------------ | ------------------ |
|
||
|
|
| `master` (latest) | :white_check_mark: |
|
||
|
|
| Latest release tag | :white_check_mark: |
|
||
|
|
| Older releases | :x: |
|
||
|
|
|
||
|
|
Always run the most recent image (`ghcr.io/rennf93/roboco:latest`) or build
|
||
|
|
from the latest `master`.
|
||
|
|
|
||
|
|
## Reporting a Vulnerability
|
||
|
|
|
||
|
|
**Please do not open a public GitHub issue for security vulnerabilities.**
|
||
|
|
|
||
|
|
Report privately through one of:
|
||
|
|
|
||
|
|
1. **GitHub Security Advisories (preferred).** Go to the repository's
|
||
|
|
**Security** tab → **Report a vulnerability**, which opens a private
|
||
|
|
advisory visible only to you and the maintainer.
|
||
|
|
2. **Email.** Contact the maintainer at **rennf93@gmail.com**. Use a subject
|
||
|
|
line beginning with `[RoboCo Security]`.
|
||
|
|
|
||
|
|
Please include, where possible:
|
||
|
|
|
||
|
|
- A description of the vulnerability and its impact.
|
||
|
|
- Steps to reproduce, or a proof-of-concept.
|
||
|
|
- The affected subsystem (api, services, gateway, orchestrator, enforcement,
|
||
|
|
db, agents, mcp, panel) and version / image tag.
|
||
|
|
- Any suggested remediation.
|
||
|
|
|
||
|
|
Particularly relevant to RoboCo's design: issues that could let an agent
|
||
|
|
container exfiltrate a project git token, escape the gateway verb surface, or
|
||
|
|
escalate task-lifecycle permissions are treated as high severity.
|
||
|
|
|
||
|
|
## Response Expectations
|
||
|
|
|
||
|
|
This is a maintainer-led open-source project, so timelines are best-effort:
|
||
|
|
|
||
|
|
- **Acknowledgement:** within 5 business days of your report.
|
||
|
|
- **Initial assessment:** within 10 business days, confirming whether the
|
||
|
|
issue is accepted and its rough severity.
|
||
|
|
- **Fix & disclosure:** coordinated with you. We aim to ship a fix and publish
|
||
|
|
an advisory promptly, crediting you unless you prefer to remain anonymous.
|
||
|
|
|
||
|
|
Please give us a reasonable window to remediate before any public disclosure.
|
||
|
|
Thank you for helping keep RoboCo and its users safe.
|