| Version | Supported |
|---|---|
| 6.x | Yes |
| 5.x | Security fixes only |
| < 5.0 | No |
Do not open a public GitHub issue for security vulnerabilities.
Please report vulnerabilities via one of the following channels:
- Email: security@vellaveto.online with subject line
[SECURITY] <brief description> - GitHub Security Advisory: Report a vulnerability (preferred)
- Description of the vulnerability
- Steps to reproduce or a proof of concept
- Affected version(s)
- Impact assessment (if known)
- Acknowledgment: within 3 business days of receipt
- Triage and severity assessment: within 7 days
- Fix development and testing: target 30 days for critical/high, 90 days for medium/low
- Coordinated disclosure: we will coordinate with you on a disclosure date after a fix is available
- Advisory publication: GitHub Security Advisory published at disclosure time
We follow coordinated vulnerability disclosure. We will not pursue legal action against researchers who act in good faith.
The following are in scope:
- All code in the vellaveto/vellaveto repository
- Published Docker images (
ghcr.io/paolovella/vellaveto) - Published SDKs (Python, TypeScript, Go)
The following are out of scope:
- Third-party MCP servers or tools behind Vellaveto
- Denial-of-service attacks against hosted instances
- Social engineering of maintainers
Published advisories will be listed at github.com/paolovella/vellaveto/security/advisories.
For production deployment hardening guidance, see docs/SECURITY.md.
| Document | Description |
|---|---|
| Security Guarantees | Normative contract: what Vellaveto guarantees, assumes, and excludes |
| Assurance Case | Claim → Evidence map with reproduction commands |
| Security Model | Trust boundaries, data flows, threat coverage |
| Security Defaults | Every security-relevant default value and rationale |
| Formal Verification Scope | What is proven vs. tested vs. assumed |
| Hardening Guide | Production deployment security configuration |
| Audit History | Internal adversarial testing methodology and results |
- Critical/High (CVSS ≥ 7.0): Patch released within 30 days of confirmed triage.
- Medium (CVSS 4.0–6.9): Patch released within 90 days.
- Low (CVSS < 4.0): Addressed in next scheduled release.
- Security patches are backported to the latest minor release of each supported major version.