From 251ffeac89e84aba6bc124349d2921b4c1a3f682 Mon Sep 17 00:00:00 2001 From: Nando Vieira Date: Tue, 9 Jun 2026 20:45:55 -0700 Subject: [PATCH 1/2] Add security policy and bug bounty scope. --- SECURITY.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d7acfc8 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,13 @@ +# Security Policy and reporting a Vulnerability + +stellar-cli-docker falls under the Stellar Foundation's bug bounty program. + +To report a security problem and review the details of the program, see the [Stellar bug bounty program](https://www.stellar.org/bug-bounty-program/). + +## Scope + +The artifact this repository produces — the published `stellar/stellar-cli` Docker images — is in scope. + +The build and release tooling (`scripts/` and `.github/workflows/`) is **not** in scope. These run only in CI or on a maintainer's machine and never receive untrusted input: every value they act on comes from `builds.json` (changed only via reviewed pull requests), version-pinned GitHub Actions, repository variables/secrets set by admins, or a maintainer's own command-line arguments. The only externally-triggerable workflow requires write access to the repository. + +Findings that assume control over a script's arguments or over a repo-controlled file — argument injection, path traversal via path flags, or crashes on malformed input — therefore cross no privilege boundary and are out of scope. A report against this tooling is only considered if it shows genuinely untrusted input (for example, content from an unprivileged fork's pull request) reaching a script with concrete impact on a published image or on the runner's secrets. From 9477ee1ac4954733460ea001e22244a3781190ef Mon Sep 17 00:00:00 2001 From: Nando Vieira Date: Tue, 9 Jun 2026 20:51:42 -0700 Subject: [PATCH 2/2] Clarify bug bounty scope and fix wording. --- SECURITY.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index d7acfc8..256bb78 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,6 +1,6 @@ -# Security Policy and reporting a Vulnerability +# Security Policy and Reporting a Vulnerability -stellar-cli-docker falls under the Stellar Foundation's bug bounty program. +stellar-cli-docker falls under the Stellar Development Foundation's bug bounty program. To report a security problem and review the details of the program, see the [Stellar bug bounty program](https://www.stellar.org/bug-bounty-program/). @@ -8,6 +8,8 @@ To report a security problem and review the details of the program, see the [Ste The artifact this repository produces — the published `stellar/stellar-cli` Docker images — is in scope. -The build and release tooling (`scripts/` and `.github/workflows/`) is **not** in scope. These run only in CI or on a maintainer's machine and never receive untrusted input: every value they act on comes from `builds.json` (changed only via reviewed pull requests), version-pinned GitHub Actions, repository variables/secrets set by admins, or a maintainer's own command-line arguments. The only externally-triggerable workflow requires write access to the repository. +The build and release tooling (`scripts/` and `.github/workflows/`) is **not** in scope. The publishing path that ships images runs only after a reviewed merge or with repository write access, and the values these scripts act on come from `builds.json` (changed only via reviewed pull requests), version-pinned GitHub Actions, repository variables/secrets set by admins, or a maintainer's own command-line arguments. -Findings that assume control over a script's arguments or over a repo-controlled file — argument injection, path traversal via path flags, or crashes on malformed input — therefore cross no privilege boundary and are out of scope. A report against this tooling is only considered if it shows genuinely untrusted input (for example, content from an unprivileged fork's pull request) reaching a script with concrete impact on a published image or on the runner's secrets. +Findings that assume control over a script's arguments or over a repo-controlled file — argument injection, path traversal via path flags, or crashes on malformed input — therefore cross no privilege boundary and are out of scope. + +The `ci.yml` workflow does run on `pull_request`, so an unprivileged fork can have its own checked-out files (such as `builds.json`) processed by scripts like `validate_json.py`. Those runs execute with a read-only token and no repository secrets, and cannot publish or alter an image. A report against this tooling is only considered if it shows such genuinely untrusted input reaching a script with concrete impact on a published image or on the CI runner's secrets.