Please do NOT open a public issue for security vulnerabilities.
Use GitHub's built-in private vulnerability reporting to report vulnerabilities directly. This keeps the report private between you and the maintainers until a fix is available.
If you prefer email and have a PGP key, encrypt your report. Otherwise, include as much detail as possible in plain text.
- Description — What is the vulnerability? How does it work?
- Affected versions — Which versions of Tellstone are impacted?
- Attack vector — How can this be exploited? (network, local, configuration)
- Severity — Your assessment of the impact (Critical / High / Medium / Low)
- Reproduction steps — Minimal steps to demonstrate the issue
- Suggested fix — If you have one
- Acknowledgment — We aim to acknowledge reports within 48 hours.
- Assessment — We will evaluate the report, determine severity, and identify affected versions.
- Fix — We will develop and test a fix. For critical issues, this is prioritized.
- Disclosure — We will coordinate disclosure with the reporter. A CVE may be requested if applicable.
- Release — The fix is released and a security advisory is published.
In scope:
- Tellstone server binary (
cmd/tellstone) - All packages under
internal/ - Binary protocol (
internal/network) - RESP2 protocol (
internal/resp) - Storage engine, persistence, crypto, metrics, tracing
Out of scope:
- Third-party dependencies (report upstream)
- Issues requiring physical access to the host
- Social engineering attacks
| Version | Supported |
|---|---|
| main | ✅ |
| Severity | Description |
|---|---|
| Critical | Remote code execution, authentication bypass, data exfiltration without auth |
| High | Denial of service, privilege escalation, significant data leak with auth |
| Medium | Limited information disclosure, minor logic flaw requiring specific conditions |
| Low | Theoretical issues, requires unusual configuration or user interaction |
We appreciate your help in keeping Tellstone and its users safe.