mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 9 Packages Projects Releases Wiki Activity

docs: SECURITY.md supports the 2.x line (audit X1)

Browse Source 
Security audit 2026-10-17, finding X1, stage 0: the supported-versions
table named 1.x while the product is at 2.14 - an operator would have
read 2.x as unsupported. Latest 2.x yes, earlier 2.x and 1.x no.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 21:37:08 +03:00
co-authored by Claude Opus 5.5
parent 8820294472
commit 2c8e981f89
3 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+2
View File
@@ -25,6 +25,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
as it already did out of the origin check's.
- **ETRN is refused and no longer offered** (audit S6): Postfix's default
let anyone on port 25 flush the queue toward an inbound domain's upstream.
- **SECURITY.md names the 2.x line as the supported one** (audit X1); its
table still said 1.x.
- **The entrypoint follows no link at the DMARC maps** (audit I2): the
three `dmarc_*` maps root creates at the start were missing from the list
of paths where a symbolic link is removed first.
SECURITY.md
+4 -3
View File
@@ -3,13 +3,14 @@
## Supported versions
SelfPost follows SemVer. Fixes are issued for the **latest minor release of the
1.x line** only; there is no backporting to earlier minors. Upgrade before
2.x line** only; there is no backporting to earlier minors or to 1.x. Upgrade before
reporting if you are behind — the image tag is `ghcr.io/mixeme/selfpost:X.Y.Z`.
| Version | Supported |
|---|---|
| latest 1.x | yes |
| earlier 1.x | no — upgrade first |
| latest 2.x | yes |
| earlier 2.x | no — upgrade first |
| 1.x | no — upgrade to 2.x (guide § Upgrading) |
| 0.x | no (pre-release) |
## Reporting a vulnerability
docs/security-audit-2026-10-17.md
+2 -2
View File
@@ -714,8 +714,8 @@ the argument.
an e2e `ETRN` on 25 gets `554`. — **Opus**, 0.5 h. *Done 2026-10-17:*
testInboundRelay sends ETRN for the inbound domain; checkPostfixHardening
reads both settings back.
- [ ] **X1.** SECURITY.md's table: `latest 2.x` supported, `1.x` not. —
**Sonnet**, 0.25 h.
- [x] **X1.** SECURITY.md's table: `latest 2.x` supported, `1.x` not. —
**Sonnet**, 0.25 h. *Done 2026-10-17.*
### Stage 1 — the tenant boundary in the mail path (~7 h) → patch release