apunkt/vestige
1
0
Fork 0
mirror of https://github.com/samvallad33/vestige.git synced 2026-07-26 23:51:02 +02:00
Code Issues Projects Releases Packages Wiki Activity
vestige/SECURITY.md
Sam Valladares 6bbafc0241 fix(release): close the 3 pre-ship blockers from the final audit 
README: add the '## Vestige Pro' section so the #vestige-pro anchor that six
shipped surfaces link to actually resolves. States the price and the
zero-knowledge guarantee honestly, with no checkout link, because checkout is
not open yet.

SECURITY: 'Vulnerabilities: 0' was false at 5. Updated rustls-webpki,
quinn-proto and crossbeam-epoch; cargo audit now genuinely exits 0. Supported
versions now list 2.3.x.

Migration V20: clears connector sync cursors so the V19 idempotency repair
happens automatically on the next source_sync, instead of a changelog note
telling users to run something that could not have worked.

cloud-sync hardening: redact the sync key and passphrase from Debug, require
https (loopback carve-out), enforce a 12 character passphrase minimum.
Trace retention days are clamped so a hostile value cannot abort the process.

release.yml: add 'connectors' to the Windows and Intel Mac rows so source_sync
is a real tool on those platforms rather than a compiled-out stub.

CHANGELOG: correct three claims the audit fact-checked as false, document the
breaking plaintext-sync change, and add the two new env levers.

Gates: cargo test 1588/0, cloud-sync suite 18/0, clippy clean, svelte-check
937/0/0, dashboard build green, cargo audit 0 vulnerabilities.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-26 00:20:35 +08:00

4.3 KiB
Raw Blame History

Security Policy

Supported Versions

Version Supported
2.3.x ✅
2.2.x Critical fixes only
2.1.x Critical fixes only
2.0.x ❌
1.x ❌

Reporting a Vulnerability

If you discover a security vulnerability in Vestige, please report it responsibly:

  1. DO NOT open a public GitHub issue
  2. Email the maintainer directly (see GitHub profile)
  3. Include:
    • Description of the vulnerability
    • Steps to reproduce
    • Potential impact
    • Suggested fix (if any)

You can expect a response within 48 hours.

Security Model

Trust Boundaries

Vestige is a local MCP server designed to run on your machine with your user permissions:

  • Trusted: The MCP client or local agent that connects via stdio
  • Untrusted: Content passed through MCP tool arguments (validated before use)

What Vestige Does NOT Do

  • ❌ Make network requests during normal memory use, except first-run model download from Hugging Face
  • ❌ Require telemetry, hosted memory storage, or a cloud account
  • ❌ Access files outside its data directory
  • ❌ Send telemetry or analytics
  • ❌ Phone home to any server

Data Storage

All data is stored locally in SQLite:

Platform Location
macOS ~/Library/Application Support/com.vestige.core/vestige.db
Linux ~/.local/share/vestige/core/vestige.db
Windows %APPDATA%\vestige\core\vestige.db

Default: Data is stored in plaintext with owner-only file permissions (0600).

Encryption at Rest

For database-level encryption, build with SQLCipher:

cargo build --no-default-features --features encryption,embeddings,vector-search

Set VESTIGE_ENCRYPTION_KEY environment variable. SQLCipher encrypts all database files including the WAL journal. Alternatively, use OS-level encryption (FileVault, BitLocker, LUKS).

Input Validation

All MCP tool inputs are validated:

  • Content size limit: 1MB max
  • Query length limit: 1000 characters
  • FTS5 queries are sanitized to prevent injection
  • All SQL uses parameterized queries (params![] macro)

Dependencies

We use well-maintained dependencies and run cargo audit as part of the release gate. Status as of the v2.3.0 audit (2026-07-25, 564 crate dependencies scanned):

  • Vulnerabilities: 0
  • Warnings: 9 (3 unmaintained, 5 unsound, 1 yanked), all transitive, none with a known exploit path in Vestige

That zero is not the default state. The 2.3.0 lockfile carried 5 vulnerabilities until three transitive dependencies were updated. Resolved for this release:

Advisory Crate Issue Resolved by
RUSTSEC-2026-0185 (7.5 high) quinn-proto Remote memory exhaustion from unbounded out-of-order stream reassembly 0.11.14 -> 0.11.16
RUSTSEC-2026-0104 rustls-webpki Reachable panic parsing a certificate revocation list 0.103.11 -> 0.103.13
RUSTSEC-2026-0098 rustls-webpki Name constraints for URI names incorrectly accepted 0.103.11 -> 0.103.13
RUSTSEC-2026-0099 rustls-webpki Name constraints accepted for certificates asserting a wildcard name 0.103.11 -> 0.103.13
RUSTSEC-2026-0204 crossbeam-epoch Invalid pointer dereference in the fmt::Pointer impl 0.9.18 -> 0.9.20

rustls-webpki is the certificate validation path that Vestige Pro cloud sync depends on, so these versions are pinned forward in Cargo.lock and a downgrade is a release blocker, not a lockfile detail.

The 9 remaining warnings are not vulnerabilities and have no available fix we can apply, because each is pulled in transitively by fastembed, candle, usearch, or git2:

  • Unmaintained: core2 (RUSTSEC-2026-0105, also yanked), number_prefix (RUSTSEC-2025-0119), paste (RUSTSEC-2024-0436)
  • Unsound: anyhow (RUSTSEC-2026-0190), cxx (RUSTSEC-2026-0202), git2 (RUSTSEC-2026-0183, RUSTSEC-2026-0184), memmap2 (RUSTSEC-2026-0186)

We track these and will pull the fixes through as soon as our direct dependencies publish releases that carry them. We would rather print the real number here than a zero.

Security Checklist

  • No hardcoded secrets
  • Parameterized SQL queries
  • Input validation on all tools
  • No command injection vectors
  • No unsafe Rust code
  • Dependencies audited