Skip to content

Security and Compliance

Jump to bottom
joshuaaferguson edited this page Nov 28, 2025 · 2 revisions

Security & Compliance

Version: v2.0-beta.1

This page condenses SECURITY.md, docs/SECURITY_IMPL_GUIDE.md, docs/SECURITY_AUDIT_PREP.md, docs/BUG_BOUNTY.md, and related incident/response docs.

Current Status (v2.0-beta.1)

  • Phase: Production-ready (v2.0-beta.1)
  • Last Review: 2025-11-28
  • CVE Status: 0 Critical/High vulnerabilities - All 15 CVEs fixed in Wave 28
  • Coverage: MFA, RBAC, multi-tenancy, security headers, rate limiting, audit logging

Wave 28 Security Fixes (2025-11-28)

Severity Count Key Fixes
Critical 2 SSH auth bypass (golang.org/x/crypto), Authz zero length
High 2 DoS slow key exchange, JWT excessive memory
Moderate 10 Various crypto/network issues
Low 1 Docker/Moby firewall

Key Changes

  • JWT Migration: Migrated from unmaintained dgrijalva/jwt-go to golang-jwt/jwt/v5
  • Crypto Updates: Updated golang.org/x/crypto, golang.org/x/net to latest
  • Security Headers: Added HSTS, CSP, X-Frame-Options, X-Content-Type-Options

Reporting Vulnerabilities

  • Preferred: GitHub Security Advisories (Security → Report a vulnerability). Response target 48h; critical fixes ship within 1–7 days.
  • Alternate: security@streamspace.io.
  • Reference docs/BUG_BOUNTY.md for bounty scope (rewards up to $10k) and disclosure rules.

Hardening Checklist

  • Secrets & Config: Require strong JWT secret (32+ chars). Externalize DB credentials, webhook secrets, SMTP API keys, and plugin tokens via K8s Secrets or vault integrations.
  • Ingress: Enforce TLS, HSTS, HTTP→HTTPS redirects, and security headers (CSP, X-Frame-Options, X-Content-Type-Options).
  • Pods: Apply restricted PodSecurity policies, ReadOnlyRootFilesystem, drop capabilities, run as non-root, and mount user PVCs with least privilege.
  • Network: Deploy NetworkPolicies limiting API/controller egress, session ingress, and DB connections. Optional service mesh (Istio) + WAF (ModSecurity) supported.
  • Auth: Enable MFA, IP allowlists, DLP policies, SAML/OIDC providers, and session verification where required by compliance frameworks.
  • Monitoring: Forward audit logs to SIEM, enable Prometheus alerts for rate limit breaches, webhook failures, and hibernation anomalies.

Compliance & Audit Prep

  • Frameworks: SOC2, HIPAA, GDPR guidance documented with evidence requirements (logs, access reviews, backup schedule).
  • Artifacts: Maintain architecture diagrams, runbooks, incident response plans (docs/INCIDENT_RESPONSE.md), and change logs for auditors.
  • Testing: Execute recurring penetration tests, OWASP ZAP scans, dependency scanning (Semgrep, CodeQL, Gitleaks, govulncheck, npm audit), and Kubernetes manifest scans (Kubesec, Checkov).

Incident Response

  • Severity matrix and playbooks live in docs/INCIDENT_RESPONSE.md.
  • Expect initial acknowledgement within 1 hour for Sev-1, root cause analysis in 24 hours, and postmortem publication within 72 hours.
  • Capture forensic data (controller/API logs, audit trails, Kubernetes events) before remediation when safe.

Extending the platform (new APIs, templates, plugins) must include security considerations documented here plus updates to SECURITY.md where relevant.

Clone this wiki locally