2.5 KiB
Security Policy
Supported Versions
I provide security patches only for the latest stable releases. If you are running an older version, I strongly recommend upgrading immediately.
| Version | Supported |
|---|---|
| >= 1.0.0 | Yes |
| < 1.0.0 | No |
Reporting a Vulnerability
I take the security of Tachyon seriously. If you discover a vulnerability, please do not open a public issue.
Instead, report it through one of the following channels:
- Email: Send details to dushnilin@gmail.com
- GitHub Private Vulnerability Reporting: Use the built-in "Private vulnerability reporting" feature in the Security tab of this repository.
What to include in your report
- A clear description of the vulnerability and its potential impact.
- Steps to reproduce the issue.
- Any supporting material: screenshots, logs, proof-of-concept code.
Response timeline
- Acknowledgment: I will confirm receipt of your report within 48 hours.
- Assessment: I aim to provide an initial assessment within 7 days.
- Fix: Security patches are prioritized and released as soon as the fix is validated.
I will keep you informed throughout the process and credit you in the release notes unless you prefer to remain anonymous.
Scope
The following are considered in scope:
- Remote code execution on the router via Tachyon.
- Authentication or authorization bypass in the LuCI web interface or Telegram bot.
- Command injection through any user-supplied input (domains, proxy URLs, subscription links, etc.).
- Path traversal leading to unauthorized file access.
- DNS rebinding or DNS manipulation exploitable through Tachyon.
- Information disclosure of sensitive configuration data (API keys, proxy credentials).
The following are out of scope:
- Vulnerabilities in upstream projects (sing-box, zapret, OpenWrt itself) — report those to the respective maintainers.
- Issues that require physical access to the router.
- Denial of service through resource exhaustion from the local network only.
Safe Harbor
I support responsible disclosure. If you make a good-faith effort to report a vulnerability in accordance with this policy, I will not take legal action against you or report your activities to law enforcement.
Encryption
If you need to communicate sensitive information, you may encrypt your email using PGP. Contact me at dushnilin@gmail.com to obtain my public key.
Thank you for helping keep Tachyon and its users safe.