wtclaude
d6a93506e8
The org's standard furniture for a new repo: licence, code of conduct, security policy, contributing guide, issue and pull-request templates, and the ignore rules. No sidecar code yet — that arrives as the first pull request, so this branch exists to open one against. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4
51 lines
2.0 KiB
Markdown
51 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
Thank you for helping keep Runic Gateway and its users safe.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please do not report security vulnerabilities through public issues, pull
|
|
requests, or the wiki.** A public report tips off attackers before a fix is
|
|
available.
|
|
|
|
Instead, report privately by email to:
|
|
|
|
**whitlocktech@gmail.com**
|
|
|
|
Please include as much of the following as you can:
|
|
|
|
- The repository and component affected.
|
|
- The type of issue (e.g. authentication bypass, injection, secret exposure,
|
|
remote code execution, denial of service).
|
|
- Step-by-step instructions to reproduce, and a proof-of-concept if you have one.
|
|
- The impact — what an attacker could do with it.
|
|
- Any suggested remediation.
|
|
|
|
You will receive an acknowledgement of your report, typically within a few days.
|
|
We will keep you informed as we investigate and work toward a fix, and we are
|
|
happy to credit you in the release notes once the issue is resolved (let us know
|
|
if you would prefer to remain anonymous).
|
|
|
|
## Scope
|
|
|
|
Runic Gateway is a self-hosted platform made up of several components:
|
|
|
|
| Component | Repo | Network exposure |
|
|
|---|---|---|
|
|
| Website (site + admin + API) | `RunicGateway/website` | Internet-facing (behind a reverse proxy) |
|
|
| rust-link sidecar | `RunicGateway/Rust-Link` | The only network-facing part of the game bridge |
|
|
| Oxide bridge plugin | `RunicGateway/Rust-Plugins` | Loopback only — dials the sidecar on `127.0.0.1` |
|
|
| Documentation | `RunicGateway/docs` | Content only |
|
|
|
|
Because instances are self-hosted, the security of any given deployment also
|
|
depends on how it is configured and operated — strong secrets (`JWT_SECRET`,
|
|
`SECRET_ENC_KEY`, database and admin passwords), a correctly configured reverse
|
|
proxy and `TRUST_PROXY`, and keeping the game server itself unreachable from the
|
|
internet (only the sidecar should be exposed). See each repo's README for the
|
|
security model.
|
|
|
|
## Supported versions
|
|
|
|
This project is developed continuously and does not maintain long-term release
|
|
branches. Security fixes land on `main`; please run a recent build.
|