From 5716716bb10f254cfb2cf2059fd978f0879f43b3 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:26:39 -0400 Subject: [PATCH 1/3] Page: security policy, plus /.well-known/security.txt --- .well-known/security.txt | 6 ++ bin/check-file-allowlist.sh | 1 + security/index.html | 137 ++++++++++++++++++++++++++++++++++++ sitemap.xml | 4 ++ 4 files changed, 148 insertions(+) create mode 100644 .well-known/security.txt create mode 100644 security/index.html diff --git a/.well-known/security.txt b/.well-known/security.txt new file mode 100644 index 0000000..32e465c --- /dev/null +++ b/.well-known/security.txt @@ -0,0 +1,6 @@ +Contact: https://github.com/fosterstack/cache/security/advisories/new +Contact: https://github.com/fosterstack/www/security/advisories/new +Expires: 2027-10-08T00:00:00.000Z +Preferred-Languages: en +Canonical: https://fosterstack.com/.well-known/security.txt +Policy: https://fosterstack.com/security/ diff --git a/bin/check-file-allowlist.sh b/bin/check-file-allowlist.sh index 2d1d85f..b999f58 100755 --- a/bin/check-file-allowlist.sh +++ b/bin/check-file-allowlist.sh @@ -29,6 +29,7 @@ ALLOW_PATTERNS=( '^favicon-(16|32)\.png$' '^apple-touch-icon\.png$' '^\.gitignore$' + '^\.well-known/security\.txt$' '^\.githooks/pre-commit$' '^bin/check-file-allowlist\.sh$' '^\.github/workflows/[A-Za-z0-9._-]+\.ya?ml$' diff --git a/security/index.html b/security/index.html new file mode 100644 index 0000000..94e5054 --- /dev/null +++ b/security/index.html @@ -0,0 +1,137 @@ + + + + + +Security policy: how to report a vulnerability + + + + + + + + +
+ +
Infrastructure worth keeping — and kept patched.
+
+
+

Security policy: how to report a vulnerability

+

Found a security problem in FosterStack Cache or on this website? Tell us privately. Here is how, what happens next, and what we sign and publish so you can check our work.

+ +

Report a vulnerability

+ +

Send the report, not a patch. You will be credited in the fix. Please do not post details publicly before a fix ships.

+ +

What we aim for

+

We aim to ship fixes for dependency vulnerabilities within 48 hours of public disclosure. That is a target, not a promise you can hold us to. Security patches are never withheld from the free tier: the same fix ships to everyone on the same day.

+

The supported version is the latest minor release.

+ +

What we sign and publish

+

Releases are built only in CI. Each one comes with files you can check without an account:

+ +

The commands are under "Verifying a release" in RELEASING.md. See also how we build.

+

Every published image is scanned again every day, so a vulnerability disclosed against something we already shipped raises an issue.

+ +

What the server does with your data

+

The server sends no telemetry and needs no connection to FosterStack: no usage reporting, no licence check, no update ping. It stores what your build tool sends it, which is cache keys and the files they point to. You can check that it makes no outbound connections, and the command is in the security policy on GitHub.

+

This website has no forms, no cookies, no analytics and no third-party requests.

+ +

What we do not claim

+ + +

Machine-readable contact: security.txt.

+
+ Full security policy on GitHub + FosterStack home +
+
+ + + diff --git a/sitemap.xml b/sitemap.xml index 8c1e470..a9f9611 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -16,4 +16,8 @@ weekly 1.0 + + https://fosterstack.com/security/ + 2026-10-08 + From 52008f5f77ee1a4476f4ba2ea1d4390828ec2ccd Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:30:08 -0400 Subject: [PATCH 2/3] Security page: drop the credit promise --- security/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/index.html b/security/index.html index 94e5054..def9a7b 100644 --- a/security/index.html +++ b/security/index.html @@ -87,7 +87,7 @@

Report a vulnerability

  • For this website: private vulnerability report on GitHub.
  • If GitHub's form is not available to you, open an issue that asks for a private channel, with no details in it. We will follow up.
    • -

    Send the report, not a patch. You will be credited in the fix. Please do not post details publicly before a fix ships.

    +

    Send the report, not a patch. Please do not post details publicly before a fix ships.

    What we aim for

    We aim to ship fixes for dependency vulnerabilities within 48 hours of public disclosure. That is a target, not a promise you can hold us to. Security patches are never withheld from the free tier: the same fix ships to everyone on the same day.

    From 24024aff915bc41076dfb44d038e704c1bdcddd0 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:50:07 -0400 Subject: [PATCH 3/3] Owner cold-read edit: cut the "nobody runs it" line --- security/index.html | 1 - 1 file changed, 1 deletion(-) diff --git a/security/index.html b/security/index.html index def9a7b..0e1d048 100644 --- a/security/index.html +++ b/security/index.html @@ -111,7 +111,6 @@

    What the server does with your data

    What we do not claim