Security policy: how to report a vulnerability

Found a security problem in FosterStack Cache or on this website? Tell us privately. Here is how, what happens next, which version gets fixes, and what we sign and publish so you can check our work.

DRAFT for v0.3, private preview, not published and never merged before v0.3.0 is live.

Report a vulnerability

• For the cache server and its releases: private vulnerability report on GitHub.
• For this website: private vulnerability report on GitHub.
• If GitHub's form is not available to you, open an issue that asks for a private channel, with no details in it. We will follow up.

Send the report, not a patch. Please do not post details publicly before a fix ships.

Kept patched

We keep FosterStack Cache patched. Vulnerable dependencies fixed fast — our target is 48 hours from disclosure (the scope is in SECURITY.md). Security patches are never withheld from the free tier: the same fix ships to everyone on the same day.

Which version gets fixes

"LTS" means a version that keeps getting fixes, so you can stay on it. Today the supported version is the latest minor release: there is no list of older versions that get fixes.

• To get a fix, move to a supported release.
• Pin the image to an exact version or digest, not latest, so a deploy never changes without you choosing it.
• Upgrade on a routine. A build cache is disposable, so an upgrade that goes wrong costs you slower builds while it refills, not lost work.
• Watch the repository's releases on GitHub. It is the one notice channel, and you can stop at any time. We do not collect email.

What we sign and publish

Releases are built only in CI. Each release goes through the steps on how we build and comes with files you can check without an account.

• Container images, signed without a stored key (Sigstore), with build provenance.
• checksums.txt with its own signature file.
• A software bill of materials (SBOM) for each binary archive.
• A VEX file saying which known vulnerabilities do and do not affect the release.
• A release-manifest.json listing every file and its digest.

The commands are under "Verifying a release" in RELEASING.md. See also how we build.

The current release's images are scanned again every day, so a vulnerability disclosed against something we already shipped raises an issue.

What the server does with your data

The server sends no telemetry and needs no connection to FosterStack: no usage reporting, no licence check, no update ping. It stores what your build tool sends it, which is cache keys and the files they point to. You can check that it makes no outbound connections, and the command is in the security policy on GitHub.

This website has no forms, no cookies, no analytics and no third-party requests.

What we do not claim

• The server has a read-write login and an optional read-only login. There is no per-person identity.
• The paid tiers are not built.
• We do not promise a date for any release or any support period.

Machine-readable contact: security.txt.