Skip to content

Reporting a security problem

If you think you've found a security problem in Ferrule, please tell us privately first, so it can be fixed before it's widely known.

Email [email protected]. Please don't open a public GitHub issue for it.

The same address is in /.well-known/security.txt, the standard place security researchers look (RFC 9116).

What to send

  • What the problem is, and what someone could do with it.
  • How to reproduce it: the steps, and anything you sent to Ferrule.
  • The Ferrule version, from Settings or the image tag.
  • How you'd like to be credited, or that you'd rather not be.

Please don't include real credentials, or data from systems that aren't yours.

What happens next

  1. We acknowledge your report, usually within three working days.
  2. We confirm the problem and agree a date for a fix with you. For most problems that's within 90 days.
  3. The fix ships in a release. Its notes say what was fixed and credit you, unless you'd rather not be named.

If a problem is being exploited, we'll move faster and tell users how to protect themselves before a fix is out.

What's in scope

  • The Ferrule collector and its dashboard, in the published image.
  • The license check, and the service it talks to.
  • This docs site.

Problems in the systems Ferrule reads from (Proxmox, vCenter, UniFi, your NAS and so on) belong with their makers. If Ferrule makes one of them worse, for example by needing more access than it should, that's in scope.

Good faith

If you test in good faith, only against systems you own or have permission to test, and give us a reasonable time to fix a problem before you publish it, we won't take action against you for the research.

Which versions get fixes

During the private beta, fixes go into the current release only. Update to it to get them (Updating Ferrule).

What's in the image

New in the next release

This is on the dev builds now, and in the next release.

Each image carries its software bill of materials, in CycloneDX format, at /sbom.cdx.json. It lists everything the image holds: the Ferrule binary, the Go standard library it's built from (Ferrule uses no third-party libraries), and the CA certificate bundle. Each release also publishes it in the deploy repository, under sbom/.