Skip to content

Latest commit

 

History

History
76 lines (50 loc) · 2.28 KB

SECURITY.md

File metadata and controls

76 lines (50 loc) · 2.28 KB
Raw

NATS Client Tools Security Policy

This repository contains an installer for the open source NATS client tools, and manages nightly builds by Synadia of those tools, for use by that installer.

So that you know who you're talking to:

  • NATS is an open source project under CNCF aegis
  • Synadia Communications, Inc are the primary developers of NATS
  • ConnectEverything is the GitHub Organization of Synadia Communications

The open source tools are:

  1. nats: https://github.com/nats-io/natscli
  2. nsc: https://github.com/nats-io/nsc

The security policy for those tools, together with past advisories, etc can be found at:

https://advisories.nats.io/

If you use the GitHub private reporting on this repository, for an open source tool, then the maintainers here will route your request to the right people, but it's not ideal.

Email

Address

  1. Open Source: mailto:[email protected]
  2. Synadia: mailto:[email protected]

(As an implementation detail, they might happen to be the same thing.)

Email Security

  • Both synadia.com and nats.io can safely be configured in your mail-systems to coerce TLS.
  • Most folks reading that list do not use OpenPGP. If you believe that the use of OpenPGP is warranted, then, since security@ is a non-reencrypting mailing-list (sorry)
    • Reach out to find who will take your report
    • Both domains have WKD set up to provide OpenPGP keys via a trusted path

This Repo

In this repository, client-tools, you will find:

  1. An installer script for end-users to run on their machines
    1. install.sh for POSIX-ish systems
    2. install.ps1 for Windows systems
  2. Copies of the public keys used to sign artifacts
  3. The configuration which creates nightly builds of the open source tools
  4. The website framework for get-nats.io
  5. Example completion files and shell configuration for zsh

Any of the things specific to this repository can and should be reported to Synadia.

You can use the private-report functionality of this repo, or the mailing-list above, at your discretion.

Bounties

At this time, there is no bug bounty system in place for either Synadia or NATS.

If you'd like some swag, we can happily oblige.