Kahi is pre-1.0: the current supported line is the latest 0.x minor. Only the latest minor release receives security updates. Once a new minor is released, the previous minor is supported for 30 days to allow time for upgrades. The same policy applies to 1.x after the 1.0 release.

Do not open a public issue for security vulnerabilities.

Use GitHub private vulnerability reporting to submit a report directly through the repository. This keeps the report confidential and allows us to collaborate on a fix before public disclosure.

If you cannot use GitHub private vulnerability reporting, send an email to:

schwicht+kahi+security@gmail.com

Include the following in your report:

• Description of the vulnerability
• Steps to reproduce (minimal reproduction case preferred)
• Affected version(s)
• Impact assessment (what an attacker could achieve)

If we cannot meet the 90-day fix timeline, we will communicate the delay and provide a revised timeline before the deadline expires.

The following are considered security issues:

• Remote code execution
• Privilege escalation (process escaping its configured uid/gid/umask)
• Unauthorized access to the control API or Unix socket
• Path traversal in configuration file inclusion
• Log injection leading to terminal escape attacks
• Denial of service through crafted configuration

The following are not considered security issues:

• Crashes or panics that require local access to trigger
• Performance degradation under heavy load
• Misconfiguration by the operator (e.g., world-readable socket)
• Vulnerabilities in dependencies (report these upstream; we will update)

We follow a coordinated disclosure process:

1. Reporter submits vulnerability through a private channel.
2. We acknowledge receipt within 48 hours.
3. We work with the reporter to understand and reproduce the issue.
4. We develop and test a fix on a private branch.
5. We assign a CVE identifier if applicable.
6. We release the fix and publish a security advisory simultaneously.
7. Reporter may publish their own writeup after the advisory is public.

We ask reporters to avoid public disclosure until a fix is available or 90 days have elapsed, whichever comes first.

This repository has the following GitHub security features enabled:

• Private vulnerability reporting -- confidential advisory workflow
• Secret scanning -- detects accidentally committed secrets
• Push protection -- blocks pushes containing detected secrets