Report a security problem

Kosmotheka keeps a household’s catalog and who can change it. If you find a way to read or change data you should not, to pass as a device or to get around the permission rules, tell us in private before anyone else.

How to report

Do not open a public issue. A flaw told in public can be used by anyone before there is a fix.

Use GitHub’s private reporting:

1. Go to the project’s repository, on the Security tab.
2. Click Report a vulnerability.
3. Write the report. Only whoever maintains the project can see it.

The repository’s SECURITY.md says the same.

What to include

The more concrete it is, the sooner it gets fixed:

• What the attacker can do, and what they need first: to be on the same network, to have a paired device, to have an account, to have a certain role.
• The steps to reproduce it.
• The version of the app or, if it is about the server, the commit.
• If you already know how it could be fixed, say so.

To know what we consider a flaw and what is a known limit, see Security: the threat model, especially the section “What it does not protect against”.

What to expect

It is a project maintained in spare time. In return:

• You will get a reply within 7 days at most.
• A serious flaw goes before any other work.
• We will mention you in the release notes, unless you prefer that we do not.

Which versions get fixes

Only the latest version of the app and the main branch of the server receive security fixes.

What it covers

• The app (desktop and Android), its local sync between devices and the operation format in spec/.
• The server in server/.

A server that another person hosts is administered by that person. If the problem is in a particular installation and not in this code, tell whoever administers it. If it is in our code, tell us.

Always test on your own installation, not on another person’s server.