Stella Ops Security Policy & Responsible Disclosure

Version 3 · 2025‑07‑15

0 · Supported versions 🗓️

Release line Status Security fix window
v0.1 α (late 2025) Upcoming 90 days after GA of v0.2
v0.2 β (Q1 2026) Planned 6 months after GA of v0.3
v0.3 β (Q2 2026) Planned 6 months after GA of v0.4
v0.4 RC (Q3 2026) Planned Until v1.0 GA
v1.0 GA (Q4 2026) Future LTS 24 months from release

Pre‑GA lines receive critical and high‑severity fixes only.

1 · How to report a vulnerability 🔒

Channel PGP‑encrypted? Target SLA
security@stella-ops.org Yes – PGP key: /keys/#pgp 72 h acknowledgement
Matrix DM → @sec‑bot:libera.chat Optional 72 h acknowledgement
Public issue with label security No (for non‑confidential flaws) 7 d acknowledgement

Please include:

  • Affected version(s) and environment
  • Reproduction steps or PoC
  • Impact assessment (data exposure, RCE, DoS, etc.)
  • Preferred disclosure timeline / CVE request info

2 · Our disclosure process 📜

  1. Triage – confirm the issue, assess severity, assign CVSS v4 score.
  2. Patch development – branch created in a private mirror; PoCs kept confidential.
  3. Pre‑notification – downstream packagers & large adopters alerted 72 h before release.
  4. Co‑ordinated release – patched version + advisory (GHSA + CVE) + SBOM delta.
  5. Credits – researchers listed in release notes (opt‑in).

We aim for 30 days from report to release for critical/high issues; medium/low may wait for the next scheduled release.

3 · Existing safeguards ✅

Layer Control
Release integrity cosign signatures + SPDX SBOM on every artefact
Build pipeline Reproducible, fully declarative CI; SBOM diff verified in CI
Runtime hardening Non‑root UID, distroless‑glibc base, SELinux/AppArmor profiles, cgroup CPU/RAM caps
Access logs Retained 7 days, then sha256(ip) hash
Quota ledger Stores token‑ID hash only, no plain e‑mail/IP
Air‑gap support Signed Offline Update Kit (OUK) validated before import
Secure defaults TLS 1.3 (or stronger via plug‑in), HTTP Strict‑Transport‑Security, Content‑Security‑Policy
SBOM re‑scan Nightly cron re‑checks previously “clean” images against fresh CVE feeds

4 · Cryptographic keys 🔑

Purpose Fingerprint Where to fetch
PGP (sec‑team) 3A5C ​71F3 ​... ​7D9B /keys/#pgp
Cosign release key AB12 ... EF90 /keys/#cosign

Verify all downloads (TLS 1.3 by default; 1.2 allowed only via a custom TLS provider such as GOST):

cosign verify \
  --key https://stella-ops.org/keys/cosign.pub \
  registry.stella-ops.org/stella-ops/stella-ops:<VERSION>

5 · Private‑feed mirrors 🌐

The Concelier (vulnerability ingest/merge/export service) provides signed JSON and Trivy DB snapshots that merge:

  • OSV + GHSA
  • (optional) NVD 2.0, CNNVD, CNVD, ENISA, JVN and BDU regionals

The snapshot ships in every Offline Update Kit and is validated with an in‑toto SLSA attestation at import time.

6 · Hall of Thanks 🏆

We are grateful to the researchers who help keep Stella Ops safe:

Release Researcher Handle / Org
empty (your name here)