Files

T

jcoffey-dev 233e0779b7 Add the community health files ahead of going public

The repository has carried only a LICENSE and a README, which scores 42%
on GitHub's community profile against ihasmail's 85% and, more to the
point, leaves someone who finds a vulnerability with nowhere to send it
but a public issue.

SECURITY.md is the one that matters. It names cross-tenant data exposure
as the highest-severity class, since that is the guarantee this project
actually sells and the one hardest to be sure of. It also puts the two
knowingly unverified areas in front of a reporter -- Phase 4 beyond its
audit-logging guarantees, and the Windows agent, which has never run on
Windows -- so a finding there is not mistaken for a regression in a path
that was ever verified. And it declares the demo credential out of scope
explicitly: it is published on purpose, prefilled on the login page and
baked into the web bundle, so a report about it costs everyone time.

CONTRIBUTING.md is written for this tree rather than adapted loosely from
the other one: the storage/query split, PostgreSQL being control-plane
only, the enterprise/ module boundary core never imports across, and the
fact that the whole repository is AGPLv3 with no feature gate. Setup is
the compose path from the README, including COMPOSE_PROFILES, so the two
cannot drift into disagreeing.

CODE_OF_CONDUCT.md is Contributor Covenant 2.0, copied from ihasmail with
one fix: that copy never filled in the contact placeholder, so its
reporting sentence ends at "responsible for enforcement at ." -- a code of
conduct with no way to report anything. Worth fixing there too.

Signed-off-by: John Coffey <[email protected]>

2026-08-29 00:17:48 -07:00

3.7 KiB

Raw Blame History

Security Policy

Supported Versions

Cairn OBS is under active development. Security fixes are applied to the latest state of the main branch. Older tags/releases are not guaranteed to receive backported fixes.

Version	Supported
`main` (latest)	✅
Older releases	❌

Reporting a Vulnerability

Please do not open a public GitHub issue for security vulnerabilities. Public issues are visible to everyone, including potential attackers, before a fix is available.

Instead, report security issues privately by emailing:

johnellisATlinuxDOTcom

Please include as much of the following as you can:

A description of the vulnerability and its potential impact
Steps to reproduce, or a proof-of-concept
The commit of Cairn OBS affected
Which component it lives in — agent, ingest, api, search, alerting, enterprise, web, cli or the deployment charts — since they are separate binaries with separate trust boundaries
Whether it needs an authenticated session, and if so at what role

What to Expect

Acknowledgment: You should receive a response within a few days confirming the report was received.
Assessment: The issue will be triaged and its severity assessed.
Fix & disclosure: Once a fix is ready it will be published on main. We'll coordinate with you on public disclosure timing and credit, if you'd like to be credited.

Scope

In scope:

Authentication, session handling and token issuance in the control plane
Cross-tenant data exposure — anything that lets a query, dashboard, alert rule or API call read data belonging to another tenant. This is the highest-severity class for this project.
RBAC bypass: performing an action the signed-in role does not carry
Query-language injection reaching ClickHouse or Tantivy, including through the SQL escape hatch, and anything that escapes the compiler's intended plan
Log injection or parser flaws in the agent or ingest pipeline that lead to code execution, resource exhaustion, or forged records
Credential or token exposure in logs, API responses, or the web bundle
Dependency vulnerabilities that are actually exploitable in Cairn OBS's usage

Out of scope:

The public demo's demo account credential, which is deliberately published — it is prefilled on the login page and baked into the web bundle, against a database that is wiped and reseeded on a schedule
Findings against a deployment the reporter does not operate or have permission to test
Vulnerabilities in ClickHouse, Redpanda, PostgreSQL or other third-party components with no demonstrated impact on Cairn OBS — please report those upstream
Missing hardening with no demonstrated impact, and issues requiring physical access or an already-compromised host

A note on unverified components

Two parts of the tree are known not to have been exercised, and are documented as such in the README:

Phase 4 (RBAC, tenant isolation, per-tenant ClickHouse) compiles and is tested, but only its audit-logging guarantees were confirmed against a live database.
The Windows agent (EvtSubscribe, ETW, service registration) has never run on real Windows.

Reports against these are welcome and useful. Please say which one you were testing, so the finding is not mistaken for a regression in a verified path.

Disclosure Policy

We follow coordinated disclosure: please give us a reasonable window to investigate and release a fix before any public disclosure. In turn, we'll keep you updated on progress and won't leave you waiting indefinitely.

Thank you for helping keep Cairn OBS and the people running it safe.

3.7 KiB Raw Blame History