# Security policy
This policy covers the Gunnar crates in this repository (the `gunnar` server and CLI,
and the `gunnar-*` crates), the hardened appliance build, and the hosted service at
https://gunnar.rs.
## Report a vulnerability privately
Write to **gunnar@gunnar.rs**. Start the subject line with `SECURITY:`.
Do not open a public issue for a vulnerability, and do not push a proof of concept to a
public repository. If you want an encrypted channel, say so in a short first mail
without details, and we agree on one with you (for example an age key).
## What to put in a report
- The version (`gunnar --version`) or the commit, and the crate.
- The build: the default build, or the features you turned on (for example `sso`,
`mimalloc`, the appliance or the metered build).
- How to reproduce it: the steps, the configuration, and a proof of concept if you have one.
- What an attacker gains, as you see it.
- Whether you plan to publish, and when.
- The name you want in the credit, or that you want none.
## What happens next
- We acknowledge your report within **14 days**.
- We tell you whether we accept it as a vulnerability, and we keep you informed while we
work on it.
- Our target is a fix or a documented mitigation within **60 days** of the report. For a
critical vulnerability we aim for 14 days.
- We agree the publication date with you. By default we publish when the fix is
released, and at the latest 90 days after the report.
- We credit you in the CHANGELOG and in the advisory, unless you ask us not to.
## Supported versions
Only the latest release line gets security fixes.
| Version | Supported |
|---|---|
| 1.5.x (latest: 1.5.1 on crates.io) | Yes |
| Older than 1.5 | No |
A fix lands on `master` first and ships in the next release on the supported line.
## How fixes are announced
- Every release has a section in [CHANGELOG.md](CHANGELOG.md). It lists each fixed
vulnerability with its CVE, RUSTSEC or GHSA id.
- For a vulnerability in Gunnar's own code, we publish a RustSec advisory for the affected
crate (https://rustsec.org), and we request a CVE or a GHSA where one applies.
- For a vulnerability in a dependency, the CHANGELOG names the upstream advisory and the
version that fixes it.
## Dependency advisories
`cargo xtask cve` runs cargo-deny against the RustSec advisory database. An advisory
fails the gate unless `deny.toml` ignores it, and every ignore there states its reason.
An ignore is only for an advisory that has no fixed version and that we have checked
cannot be reached in Gunnar (for example RUSTSEC-2023-0071 in `rsa`: Gunnar's SSH host
key is ed25519 only).