Security policy
This policy covers the Gunnar crates in this repository (the gunnar server and CLI, and the gunnar-* crates), the hardened appliance build, and the hosted service at https://www.gunnar.rs.
Report a vulnerability privately
Write to gunnar@gunnar.rs. Start the subject line with SECURITY:.
Do not open a public issue for a vulnerability, and do not push a proof of concept to a public repository. If you want an encrypted channel, say so in a short first mail without details, and we agree on one with you (for example an age key).
What to put in a report
- The version (
gunnar --version) or the commit, and the crate. - The build: the default build, or the features you turned on (for example
sso,mimalloc, the appliance or the metered build). - How to reproduce it: the steps, the configuration, and a proof of concept if you have one.
- What an attacker gains, as you see it.
- Whether you plan to publish, and when.
- The name you want in the credit, or that you want none.
What happens next
- We acknowledge your report within 14 days.
- We tell you whether we accept it as a vulnerability, and we keep you informed while we work on it.
- Our target is a fix or a documented mitigation within 60 days of the report. For a critical vulnerability we aim for 14 days.
- We agree the publication date with you. By default we publish when the fix is released, and at the latest 90 days after the report.
- We credit you in the CHANGELOG and in the advisory, unless you ask us not to.
Supported versions
Only the latest release line gets security fixes.
| Version | Supported |
| 1.6.x (latest: 1.6.0 on crates.io) | Yes |
| Older than 1.6 | No |
A fix lands on master first and ships in the next release on the supported line.
How fixes are announced
- Every release has a section in CHANGELOG.md. It lists each fixed vulnerability with its CVE, RUSTSEC or GHSA id.
- For a vulnerability in Gunnar's own code, we publish a RustSec advisory for the affected crate (https://rustsec.org), and we request a CVE or a GHSA where one applies.
- For a vulnerability in a dependency, the CHANGELOG names the upstream advisory and the version that fixes it.
Threat model
docs/THREAT-MODEL.md is the threat model and assurance case: the assets, the trust boundaries, the attackers, the mitigations with the code that holds each one, and the residual risks and known gaps. A test (xtask/tests/threat_model.rs) keeps every code citation in it current.
Dependency advisories
cargo xtask cve runs cargo-deny against the RustSec advisory database. An advisory fails the gate unless deny.toml ignores it, and every ignore there states its reason. An ignore is only for an advisory that has no fixed version and that we have checked cannot be reached in Gunnar (for example RUSTSEC-2023-0071 in rsa: Gunnar's SSH host key is ed25519 only).