mix
04993e0da3
A public repository with no stated disclosure channel routes a finder into opening a public issue, which discloses a relay flaw to everyone the moment it is filed. SECURITY.md points at the repository private vulnerability reporting instead, with public@mixeme.ru as fallback, and states scope so operator-side configuration (blocked port 25, missing PTR, proxy TLS) does not arrive as a report. No response time is promised: a deadline that cannot be honoured by a single maintainer is worse than none. Silence is explicitly not a request for a continued embargo. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
3.6 KiB
Security policy
Supported versions
SelfPost follows SemVer. Fixes are issued for the latest minor release of the
1.x line only; there is no backporting to earlier minors. Upgrade before
reporting if you are behind — the image tag is ghcr.io/mixeme/selfpost:X.Y.Z.
| Version | Supported |
|---|---|
| latest 1.x | yes |
| earlier 1.x | no — upgrade first |
| 0.x | no (pre-release) |
Reporting a vulnerability
Do not open a public issue. Use GitHub's private vulnerability reporting:
the Report a vulnerability button under the repository's
Security tab. If you cannot use
it, mail public@mixeme.ru instead.
Useful in a report: the image tag, the reverse proxy in front of the panel, the
steps to reproduce, and what an attacker gains. A relevant excerpt of
mail.log or the panel's system log helps; strip recipient addresses first.
No response time is promised. SelfPost is maintained by one person, and a deadline that cannot be honoured is worse than none. Reports are read and answered as soon as the maintainer is able; a fix ships in a patch release, with the timeline agreed in the thread.
Disclosure is coordinated by request, not by demand: please hold public details until a patch is out. If you get no reply, that is not a request for a continued embargo — disclose at your own discretion. Reporters are credited in the CHANGELOG unless they ask not to be.
In scope
The relay's job is to accept authenticated mail from an application and hand it to the internet as the operator's domain, and nothing else. Breaking that is in scope:
- Open relay — mail accepted from an unauthenticated sender, or relayed for a domain the sending application is not bound to
- SASL bypass — sending without valid credentials, or credential recovery from anything the container exposes
- Cross-domain access — an application or a panel session reaching a domain it was not granted
- Secret disclosure — DKIM private keys, the admin password hash, session tokens, or backup encryption material leaking to an unauthorised party
- Panel authentication and session flaws — login bypass, session fixation, CSRF on state-changing routes, privilege escalation
- Rate-limit bypass — evading either the Postfix-level backstop or the per-domain and per-application limits
- Container escape or privilege escalation from the panel's unprivileged user to root
Out of scope
These are the operator's responsibility or accepted trade-offs, documented in docs/security.md and the operator guide:
- Host configuration the operator controls: a blocked port 25, a missing or wrong PTR record, DNS records not published, a self-signed or expired certificate on the reverse proxy
- Anything requiring the attacker to already have root on the host or write
access to the
./databind mount - Missing hardening headers or TLS options on the reverse proxy — SelfPost never terminates HTTPS itself
- Deliverability outcomes: mail rejected or filtered by a receiving provider is a policy decision of that provider, not a defect
- Denial of service through sheer volume against a single-tenant relay
- Vulnerabilities in upstream Postfix, OpenDKIM, or the base image — report those upstream; if SelfPost's configuration makes an upstream issue exploitable when it otherwise would not be, that is in scope
Reports we cannot act on
Automated scanner output with no demonstrated impact, and reports whose only content is a version number compared against a CVE list, are closed without investigation.