| Version | Supported |
|---|---|
3.x |
✅ |
2.0.x |
maintenance — security fixes only |
1.x |
❌ end-of-life |
Only versions published to nuget.org from a v* tag are supported. There is no second feed — a build that carries no tag is not something we ship, and a report against one is a report against an unreleased tree.
Prereleases are in scope. A v* tag may name one (4.0.0-preview.1), and it is published precisely so that it gets tested — a finding against a prerelease is welcome and is handled like any other. It is not a build to run in production: it exists to be reported on before the version it precedes becomes final.
If you believe you have found a security issue in Stratara, please do not open a public issue. Send a private report to:
Include enough detail to reproduce: package + version, the affected API surface, a minimal repro, and the expected vs. observed behaviour. Encrypt with our public key if the disclosure is sensitive (PGP key on request).
We aim to acknowledge within 5 business days and ship a fix or an explicit "won't fix" decision within 30 days for actionable reports. Severe issues are coordinated with downstream consumers on a private channel before public disclosure.
- Vulnerabilities in third-party dependencies (report to the respective project)
- Issues that require physical access to the host running Stratara
- Self-XSS, CSRF on local-only endpoints, and other findings that depend on the consumer's hosting configuration rather than the framework code
- Findings against unreleased code — the
mainbranch between tags, or a fork
Stratara routes commands and events through an IMessageBus implementation (RabbitMQ, Azure Service Bus). The bus itself is treated as a trusted transport: any party with publish credentials can place arbitrary CommandEnvelope and EventBundle messages onto the topic.
Each envelope carries a SessionContextJson field that drives the consumer-side ISessionContextProvider.Set(...) call and the AAD used for AES-GCM decryption. A hostile publisher who can mint envelopes with attacker-chosen TenantId / ActorTenantId / ActorUserId values can therefore impersonate any tenant — the framework treats the field as trusted by default.
Mitigation (opt-in). Call services.AddBusEnvelopeIntegrity(o => { o.SharedKey = …; o.Mode = BusEnvelopeIntegrityMode.Strict; }) on every publisher and consumer that share a bus. The framework then HMAC-SHA256-signs a canonical projection of each outbound envelope and verifies it on the receiving side. The projection covers every field of the message except the signature itself — for CommandEnvelope the envelope id, CommandTypeName, SessionContextJson, the heavy-lane flag and a SHA-256 digest of CommandJson; for EventBundle SessionContextJson and a SHA-256 digest over every field of every carried event — with each field length-prefixed so content cannot be shifted across a field boundary. A forged SessionContextJson and a payload transplanted under a captured signature both fail verification. See BusEnvelopeIntegrityOptions for the Off / Permissive / Strict enforcement modes — Permissive is the recommended rolling-deployment step before flipping the fleet to Strict. Releases before 3.4.0 signed the identity slice only and did not bind the payload; signatures they produced do not verify against 3.4.0, so cross that boundary through Permissive as well — see Bus-Envelope Integrity (HMAC).
Threat model when integrity is Off. The framework is safe against the default attack on encryption (a hostile publisher cannot read encrypted payloads), but is not safe against impersonation by a publisher who tampers with SessionContextJson. Treat publish credentials with the same scrutiny as application-tier secrets.