SECURITY - master - advanceddev/license-server

SECURITY
92 строки3 KB
advanceddev
Create: SECURITY
09 авг 2026, 20:11
09 авг 2026, 20:11839583e
Security Policy

Supported Versions

Version 1.x is supported. Versions below 1.0 are not supported.

Reporting a Vulnerability

Please do NOT open public issues for security vulnerabilities.

How to Report

Contact via Telegram: @frntbck (https://t.me/frntbck)

Include in your report:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

What to Expect

- Acknowledgement within 48 hours
- Status update every 7 days until resolution
- Resolution target: critical — 7 days, high — 30 days, medium/low — best effort
- Reporters will be credited in release notes unless anonymity is requested

Security Measures

This project implements the following security controls:

Authentication and Authorization
- Admin API protected by Bearer token (ADMIN_API_KEY)
- License keys stored as SHA-256 hashes only, plaintext keys are never persisted
- One active license per partner enforced at database level via trigger

Input Validation
- Strict JSON decoding with rejection of unknown fields
- Structural validation via go-playground/validator
- All user input validated before processing

Rate Limiting
- Two-tier rate limiting: per IP and per license key
- Nginx-level rate limiting as first line of defense
- Redis-backed application-level rate limiting as second line
- Fail-open strategy for rate limiter errors

Network Security
- Nginx reverse proxy with security headers (X-Content-Type-Options, X-Frame-Options, etc.)
- Gzip compression only for safe content types
- No direct exposure of application port in production

Data Protection
- Audit logging of all administrative actions and license validations
- Structured logging with request tracing via Request ID
- Secrets managed via environment variables, never committed to repository
- .env excluded from Docker image and version control

Dependencies
- Go modules with checksum verification (go.sum)
- Minimal base images (Alpine) to reduce attack surface
- Regular dependency updates recommended

Known Security Considerations

- Rate limit bypass via IP rotation: Per-IP rate limiting can be circumvented by distributed attackers. Per-key rate limiting provides additional protection for compromised license keys.
- Cache timing attacks: Cache hit/miss timing differences could theoretically leak information about license validity. In practice, this is mitigated by constant-time response formatting.
- Audit log integrity: Audit logs are stored in the same PostgreSQL instance as application data. For higher assurance, consider shipping audit logs to an append-only external store.

Responsible Disclosure

We follow responsible disclosure principles:
1. Reporter submits vulnerability privately
2. We confirm and assess severity
3. Fix is developed and tested
4. Patch is released
5. Public disclosure after users have had reasonable time to update (typically 90 days)

Scope

In scope:
- License server backend (Go application)
- Nginx configuration
- Database schema and migrations
- Docker and deployment configuration
- Client integration middleware

Out of scope:
- Third-party services integrated by downstream consumers
- Social engineering attacks against maintainers
- Denial of service without novel technique
- Issues in unsupported versions