# Security Policy

Thank you for helping keep Runic Gateway and its users safe.

## Reporting a vulnerability

**Please do not report security vulnerabilities through public issues, pull
requests, or the wiki.** A public report tips off attackers before a fix is
available.

Instead, report privately by email to:

**whitlocktech@gmail.com**

Please include as much of the following as you can:

- The repository and component affected.
- The type of issue (e.g. authentication bypass, injection, secret exposure,
  remote code execution, denial of service).
- Step-by-step instructions to reproduce, and a proof-of-concept if you have one.
- The impact — what an attacker could do with it.
- Any suggested remediation.

You will receive an acknowledgement of your report, typically within a few days.
We will keep you informed as we investigate and work toward a fix, and we are
happy to credit you in the release notes once the issue is resolved (let us know
if you would prefer to remain anonymous).

## Scope

Runic Gateway is a self-hosted platform made up of several components:

| Component | Repo | Network exposure |
|---|---|---|
| Website (site + admin + API) | `RunicGateway/website` | Internet-facing (behind a reverse proxy) |
| uo-link sidecar | `RunicGateway/link` | The only network-facing part of the game bridge |
| ServUO plugin | `RunicGateway/servuo-plugins` | Loopback only — dials the sidecar on `127.0.0.1` |
| Installer | `RunicGateway/installer` | Not a service — an operator-run deployment tool (see below) |
| Documentation | `RunicGateway/docs` | Content only |

Because instances are self-hosted, the security of any given deployment also
depends on how it is configured and operated — strong secrets (`JWT_SECRET`,
`SECRET_ENC_KEY`, database and admin passwords), a correctly configured reverse
proxy and `TRUST_PROXY`, and keeping the shard itself unreachable from the
internet (only the sidecar should be exposed). See each repo's README for the
security model.

### Installer-specific notes

The installer runs with elevated privileges on the shard host, downloads other
components, and handles the sidecar's auth token. Three things follow from that,
and they are policy rather than oversight:

- **Releases are unsigned.** `SHA256SUMS`, published with every release, is the
  trust anchor. Verify the checksum of any installer binary before running it.
  Windows SmartScreen and macOS Gatekeeper warnings are expected.
- **The installer verifies what it downloads.** Component artifacts (the sidecar
  binary, the overlay tarball) are checked against the publishing repo's
  `SHA256SUMS` and refused on mismatch. A report of a bypass in that check is a
  security issue, not a bug report.
- **The installer never contacts the website.** It prints the sidecar's base URL,
  WebSocket URL, protocol version, and auth token for the operator to paste into
  Admin → Shard. Anything that would transmit that token automatically is out of
  scope by design.

## Supported versions

This project is developed continuously and does not maintain long-term release
branches. Security fixes land on `main`; please run a recent build.