SunLionet Vulnerability Response Lifecycle
1. Objective
To provide a secure, predictable, and responsible process for reporting and fixing security vulnerabilities in SunLionet.
2. Reporting a Vulnerability
- Primary Channel: Email to
security@sunlionet.org (Encrypted via GPG).
- GPG Key: Published at
https://sunlionet.org/security.asc and in the repo as SECURITY_GPG_KEY.asc.
- What to include:
- Description of the vulnerability.
- Steps to reproduce (POC).
- Potential impact (e.g., user deanonymization, config leak).
- Affected versions and platforms.
3. Triage and Intake
- Acknowledgement: The Security Response Team (SRT) acknowledges receipt within 24 hours.
- Triage: SRT evaluates the report for validity and severity (P0/P1/P2).
- Verification: SRT attempts to reproduce the vulnerability in a controlled environment.
- Status Update: Reporter is notified if the issue is accepted as a vulnerability.
4. Severity Handling
| Severity |
Target Fix Time |
Communication |
| P0 (Critical) |
< 24 Hours |
Security Advisory (Pre-release) + Emergency Patch. |
| P1 (High) |
< 72 Hours |
Security Advisory + Point Release. |
| P2 (Medium) |
Next Release Cycle |
Mention in Changelog + Standard Release. |
5. Fix and Coordinated Disclosure
- Development: A fix is developed in a private branch.
- Verification: The fix is verified by the SRT and, if possible, the original reporter.
- Draft Advisory: An advisory is drafted explaining the vulnerability and the fix.
- Release: The fix is merged and a new version is released.
- Disclosure: The Security Advisory is published on GitHub, the official website, and the Telegram channel.
6. Emergency Patch Expectations
- For P0 vulnerabilities, the “Emergency Response Authority” (defined in
docs/governance/model.md) may be used to bypass standard 2-of-N release signatures for a fast patch.
- The priority is user safety (e.g., disabling a broken feature) over feature completeness.
7. Bug Bounty and Recognition
- SunLionet does not currently offer financial bounties but provides:
- Hall of Fame recognition (if requested).
- Priority invitation to the Security Review Group (SRG).
- Transparent public credit in the Security Advisory.
8. Out-of-Scope
- Physical attacks on user devices.
- Social engineering.
- Vulnerabilities in third-party services (e.g., Telegram, GitHub) unless they directly impact SunLionet’s trust roots.