From ef4a6673cc5a826d76b3bdcc11fa04a668f3e52d Mon Sep 17 00:00:00 2001 From: Marko Vejnovic Date: Fri, 16 Oct 2026 13:17:24 -0700 Subject: [PATCH 1/4] docs: add SECURITY.md The only reporting route was an email line in CONTRIBUTING.md, which GitHub's Security tab does not surface. SECURITY.md names the advisory form and the email, and scopes reports to Hyper's own code; CONTRIBUTING points at it. --- CONTRIBUTING.md | 2 +- SECURITY.md | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 SECURITY.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7f4356c4..307f859e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -111,7 +111,7 @@ mix firecracker.gen Open a GitHub issue for bugs, with the version, your environment, and a minimal reproduction. For anything security-sensitive, **do not open a public issue** --- email the maintainer at instead. +-- follow [SECURITY.md](SECURITY.md) instead. You can also ask questions in the [community Discord](https://discord.gg/hm-dev). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..f3462f8f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,12 @@ +# Security + +Report vulnerabilities privately, through [GitHub's advisory +form](https://github.com/harmont-dev/hyper/security/advisories/new) or by email +to . Do not open a public issue. + +In scope is Hyper's own code: the setuid helper (`native/suidhelper/`), the +jail, network and device-mapper plumbing it drives, the guest agent, and the +gRPC API. + +Bugs in the host kernel, KVM or Firecracker belong upstream. We track their +impact on Hyper in public issues. From d6efaf67859285ba89a20f14d0cde953e64613bd Mon Sep 17 00:00:00 2001 From: Marko Vejnovic Date: Sat, 24 Oct 2026 18:16:04 -0700 Subject: [PATCH 2/4] deslop --- SECURITY.md | 7 ------- 1 file changed, 7 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f3462f8f..0ba9e05b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -3,10 +3,3 @@ Report vulnerabilities privately, through [GitHub's advisory form](https://github.com/harmont-dev/hyper/security/advisories/new) or by email to . Do not open a public issue. - -In scope is Hyper's own code: the setuid helper (`native/suidhelper/`), the -jail, network and device-mapper plumbing it drives, the guest agent, and the -gRPC API. - -Bugs in the host kernel, KVM or Firecracker belong upstream. We track their -impact on Hyper in public issues. From a45b17025dea1259238c3c350925e0e7feb04381 Mon Sep 17 00:00:00 2001 From: Marko Vejnovic Date: Sat, 24 Oct 2026 18:29:19 -0700 Subject: [PATCH 3/4] docs: update SECURITY.md --- SECURITY.md | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 64 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 0ba9e05b..b9f691c7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,68 @@ # Security +## Reporting a vulnerability + Report vulnerabilities privately, through [GitHub's advisory form](https://github.com/harmont-dev/hyper/security/advisories/new) or by email -to . Do not open a public issue. +to . Do not open a public issue, pull request or discussion. + +Include what you can of: + +- the Hyper version or commit, and the `hyper-suidhelper` version; +- the host kernel and Firecracker versions; +- the relevant parts of `/etc/hyper/config.toml` (e.g. whether gRPC is enabled, + and how it is exposed); +- steps to reproduce, ideally a proof of concept; +- the impact, and what an attacker needs in order to exploit it. + +Reports found with automated tools, LLMs included, are welcome. Name the tool, +and check the findings yourself before sending them. + +## Disclosure + +When disclosing a vulnerability, please keep it private. Until a fix is +announced, I would prefer if we didn't expose a vulnerability to the public. + +### Credit + +Reporters are credited in the advisory unless they ask not to be. Hyper has no +bug bounty. + +## What counts as a vulnerability + +Hyper assumes that an operator is not malicious. I assume that you have +configured your BEAM cluster, postgres, any client to be safe. Hyper does +**not** trust anything running insde a VM. I consider vulnerabilities when an +untrusted party gets access only the operator should have. Some examples are: + +- **guest to host operations**: anything in a VM affecting the host or another + VM is considered a security vulnerability. +- **local user to root**: an unprivileged user making `hyper-suidhelper` + (`native/suidhelper/`) act on protected paths, within Hyper or outside, is + considered a security vulnerability. +- **API client beyond the API**: API escapes, eg. you getting `root` access + through the API is considered insecure. + +An example of a **vulnerability** is: + +> A VM successfully impersonated another VM, receiving its network traffic. + +An example of a **non-vulnerability** is: + +> gRPC access is unauthenticated. + +The latter is not considered a vulnerability, since I expect *you* and your +cluster to control access to the gRPC cluster. + +## What to expect + +I aim to provide a response as soon as possible. I have a day-job that does not +involve Hyper and, consequently, maybe be unable to immediately respond. I'll +try to acknowledge a report within a couple days, and if you do not hear from +me, open a public CVE. + +## Supported versions + +Only the [latest release](https://github.com/harmont-dev/hyper/releases/latest) +and `main` receive security fixes. + From 50f2578e41bf50567e3494cc04d487ee1e86e6e7 Mon Sep 17 00:00:00 2001 From: Marko Vejnovic Date: Sat, 24 Oct 2026 18:40:58 -0700 Subject: [PATCH 4/4] docs: include SECURITY.md in ExDoc extras CONTRIBUTING.md links to SECURITY.md, so mix docs --warnings-as-errors failed on the dangling reference. --- mix.exs | 1 + 1 file changed, 1 insertion(+) diff --git a/mix.exs b/mix.exs index 800cde02..47e56cef 100644 --- a/mix.exs +++ b/mix.exs @@ -125,6 +125,7 @@ defmodule Hyper.MixProject do "docs/cookbook/architecture.md", "docs/grpc.md", "CONTRIBUTING.md", + "SECURITY.md", "LICENSE" ], groups_for_extras: [