Security policy

Tunnelry manages the certificates and the firewall of a VPN server, so security reports are taken seriously. This page tells you how to report a security problem and what to expect. (Polish version: SECURITY.pl.md.)

Reporting a vulnerability

Please do not open a public issue or post it anywhere public. Write privately to security@tunnelry.com.

A useful report says: which part is affected (the web application, the helper vpnctl, the installer, the update mechanism or a generated configuration) and in which version (shown in the footer of the application), the steps to reproduce it, and what you think an attacker could do with it. Tell us also whether you plan to publish your findings, so that we can agree on a reasonable timeline.

You will get an answer, and a fix or a clear explanation, as fast as one person can manage. Please give the project a fair chance to fix the problem before you publish it.

Which versions are supported

The latest release receives security fixes, delivered through the signed update mechanism. Older versions are not patched: update to the latest one. Tunnelry is still at version 0.x, so a minor version may change how things work.

Scope

In scope: the web application, vpnctl, the installer, the update mechanism and the generated configuration (OpenVPN, nftables, nginx, php-fpm, unbound).

Out of scope: vulnerabilities in third-party software that are not caused by how Tunnelry configures it (report those to their own projects), and attacks that require prior root access to the server.

How the system is designed to resist attacks

The web application never runs as root and can only call one small helper through a fixed list of commands; releases and updates are signed and verified before they are installed; the firewall denies everything that a role does not allow. The assumptions the design is built on are described in the threat model that ships with the project.