💐 Sync 2026-10-06 12:33:44

minigate/SECURITY.md

@@ -0,0 +1,55 @@
+# Security Policy
+
+MiniGate touches gateway-facing features such as DDNS, ACME certificates,
+reverse proxy configuration, LuCI access, login-failure monitoring, and
+nftables bans. Please report security issues responsibly.
+
+## Supported Versions
+
+Security fixes are targeted at the latest release published on GitHub
+Releases. Users should upgrade to the latest release before reporting issues
+that may already be fixed.
+
+## Reporting a Vulnerability
+
+If you find a vulnerability, please do not publish exploit details in a public
+issue before it has been reviewed.
+
+Report privately by email:
+
+- tpxcer28@gmail.com
+
+Please include:
+
+- affected MiniGate version
+- OpenWrt or ImmortalWrt version
+- installation method, such as IPK, source install, or SDK build
+- affected feature, such as DDNS, ACME, reverse proxy, login guard, or LuCI UI
+- clear reproduction steps
+- expected impact
+
+I will try to acknowledge valid reports within 7 days and coordinate a fix or
+mitigation in a release when appropriate.
+
+## Scope
+
+In scope:
+
+- command injection or unsafe shell argument handling
+- configuration injection in generated Nginx, ACME, DDNS, or nftables files
+- authentication or authorization bypass in LuCI pages
+- unsafe handling of API tokens, certificates, private keys, or ban records
+- issues that weaken direct-IP or unknown-Host rejection behavior
+
+Out of scope:
+
+- vulnerabilities in upstream OpenWrt, ImmortalWrt, LuCI, Nginx, Cloudflare, or
+  Let's Encrypt components
+- reports that require compromised router root access as the only prerequisite
+- denial-of-service reports without a realistic router-facing impact
+
+## Disclosure
+
+Please allow time for investigation and patching before public disclosure. Once
+a fix is available, the release notes will mention the security-relevant change
+without exposing unnecessary exploit details.