--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
SECURITY.md e8e5128bc67cd3e8540bcd9f4e9be1b8d43db36a (e8e5128b) Text, 2.06 KB
Tc9d1d9# Security Policy
Tc9d1d9## Contact Information
If you discover a security vulnerability or have concerns about the security of Reticulum MeshChatX, please contact the lead developer using the following methods in order of preference:
Tff7b721. **LXMF**: Ta5d6ff`7cc8d66b4f6a0e0e49d34af7f6077b5a`
Tc9d1d9## Security Overview
Reticulum MeshChatX is designed with a high degree of security in mind, leveraging multiple layers of protection and modern security practices.
We follow the [Tff7b72Electron Best Security Practices](Te6edf3https://www.electronjs.org/docs/latest/tutorial/security)
Tc9d1d9### Core Security Features
Tff7b72- **ASAR Integrity Validation**: Utilizes Electron 39 features to protect the application against tampering.
Tff7b72- **Backend Binary Verification**: Generates a SHA-256 manifest of the unpacked Python backend during build and verifies it on every startup.
Tff7b72- **Data-at-Rest Integrity Monitoring**: Snapshots the state of identities and database files on clean shutdown and warns if they were modified while the app was closed.
Tff7b72- **CSP Hardening**: Multi-layered Content Security Policy protection across the entire application stack.
Tff7b72- **Hardened Electron Environment**: Hardened security by disabling Ta5d6ff`runAsNode` and Ta5d6ff`nodeOptions` environment variables via Electron Fuses.
Tff7b72- **Rootless Docker Images**: Support for running in restricted environments with rootless container images.
Tc9d1d9### Automated Security Measures
The project employs continuous security monitoring and testing:
Tff7b72- **Security Scanning**: Automated daily scans using OSV-Scanner and Trivy for container image vulnerabilities.
Tff7b72- **Pinned Actions**: All CI/CD workflows use pinned actions with full URLs to forked, vetted actions hosted on our Gitea instance (Ta5d6ff`git.quad4.io`) to prevent supply chain attacks.
Tff7b72- **Extensive Testing & Fuzzing**: Comprehensive backend benchmarking suite with high-precision timing, memory delta tracking, and extreme stress modes to ensure stability and prevent resource exhaustion.
Tff7b72- **Linting & Code Quality**: Strict linting rules and static analysis are enforced on every push.
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────