Security

Reporting a vulnerability

Report vulnerabilities privately through GitHub Security Advisories (“Report a vulnerability” on the repository’s Security tab), or by email to contact@polarsystems.net. Please do not open public issues for security problems.

Supported: the latest stable release.

Principles

These hold for every component and are checked in review:

• No secrets in config files or on command lines. Secrets are systemd credentials, encrypted at rest with the host key and only decrypted into the service’s private credentials directory. A config file that contains a key called token, secret, password or api_key is refused.
• No user URL is ever fetched. PolarBot analyses links by their text only. The only outbound connections are to Discord and to the public domain lists you configure.
• Least privilege. Services run as a throw-away system user (DynamicUser=yes) under a strict systemd sandbox: read-only system, no home directories, no new privileges, no capabilities, a system-call filter. See PolarBot’s security model.
• Minimal exposure. The only network listener is PolarBot’s OAuth callback, on 127.0.0.1, behind nginx with TLS; nginx forwards exactly two paths and keeps no access log.
• Fail closed. Unknown commands need the highest level, unknown config keys stop the start, a list download that looks wrong keeps the previous list, an expired or reused OAuth link is refused.
• Privacy by design. Flagged messages are not stored. See Privacy and data.

Verifying what you run

Today you build PolarBot from source, so what you run is what you checked out. Check that you are on the commit you expect before you build:

git fetch origin
git status            # "On branch stable" and "up to date with 'origin/stable'"
git log -1 --oneline  # the commit you are about to build

The running bot shows the commit it was built from in /about and in its first log line (starting polarbot version=… rev=…), so you can confirm the server runs that commit.

Signed releases (prebuilt binaries with a signed manifest) are coming with PolarInstall; the steps to check a signature by hand are in Verify a release signature by hand.