Security

Security Policy

Reporting a vulnerability

Report security bugs and vulnerabilities to shain.singh@owasp.org — or use GitHub’s private vulnerability reporting: Report a vulnerability. Do not open a public issue for an unreported vulnerability.

Email reports may be encrypted to the OpenPGP key below. Include a description of the issue, steps to reproduce, and the affected version or commit. Reports are triaged within a few days; accepted issues receive a fix and a release. Honour responsible disclosure until an advisory is published.

OpenPGP public key — fingerprint 9CB1781DC2BB28D37A0155DCAAF8226F3F4C1712 (RSA 4096, no expiry)

Special considerations for this project

OpenSASE is a TLS-inspection appliance: it sits in the path of TLS traffic and holds decryption material by design. Vulnerabilities in it are high-value by nature. Keep that in mind when testing.

This is a lab/testing appliance. Deploy it only against networks and clients you own or are authorised to test. Never point the edge at third-party traffic.
Interception material is sensitive. The mitmproxy CA private key, the OpenVPN CA and its PKI, and the JSONL decision log (which records hosts and categories of browsed traffic) must all be treated as secret material.
Test data only. The committed PKI, client certificates and keys under openvpn/, squid/ are deliberate lab fixtures (see README: do not run unmodified in production). Do not report them as leaked credentials — but do never reuse them anywhere real.
Policy bypass is a vulnerability class here. A bug that silently skips the splice/bump verdict chain, blocks clamd from returning a verdict (fail-open), or drops decision-log lines is a security bug, not a cosmetic one.

How this repository maintains security hygiene

Supply-chain and dependency integrity

Everything is built by Nix from a lockfile (flake.lock) — no floating image bases, no Dockerfile builds; CI publishes the same digests it built (.github/workflows/release-images.yml).
Per-image SPDX SBOMs are generated on every release and attached as release assets.
Dependency Review — every PR is checked for license and vulnerability differences versus its base (add .github/workflows/dependency-review.yml via the ai-sec-lab workflow).
Dependabot — dependency manifests kept current; enable alerts in repo settings.

Secret hygiene

Secret scanning and push protection — enable in repo settings (Settings → Code security & analysis); blocked pushes containing credentials.
pre-commit runs detect-private-key on every change outside the legacy PKI dirs (.pre-commit-config.yaml).

Reproducibility controls

pre-commit.ci runs the hook set on every PR — formatting, YAML/JSON validity, large-file guards, secret detection.
The appliance is a pinned NixOS flake (flake.lock); the container images are byte-identical derivations from the same nixpkgs.

Known boundaries, stated plainly

The committed keys under the legacy directories are lab fixtures, generated for this project’s own test VPN — the README marks the whole appliance do not run unmodified in production.
Transparent TCP interception in container mode is out of scope by design (Docker bridges break TPROXY); use the NixOS appliance for that mode.

Open a general issue for non-sensitive questions; security reports follow the channels above.