Security policy: how to report a vulnerability

Found a security problem in FosterStack Cache or on this website? Tell us privately. Here is how, what happens next, which version gets fixes, and what we sign and publish so you can check our work.

Report a vulnerability

• For the cache server and its releases: private vulnerability report on GitHub.
• For this website: private vulnerability report on GitHub.
• If GitHub's form is not available to you, open an issue that asks for a private channel, with no details in it. We will follow up.

Send the report, not a patch. Please do not post details publicly before a fix ships.

What we aim for

Vulnerable dependencies fixed fast — our target is 48 hours from disclosure (the scope is in SECURITY.md). Security patches are never withheld from the free tier: the same fix ships to everyone on the same day.

Long-term support: what is supported

"LTS" means a version that keeps getting fixes for a stated period, so you can stay on it. The supported version is the latest minor release. That is the whole policy. There is no separate long-term-support line, no list of older versions that get fixes, and no support period to quote.

• To get a fix, move to the latest release. Older releases are not on the supported list.
• Pin the image to an exact version or digest, not latest, so a deploy never changes without you choosing it.
• Upgrade on a routine. A build cache is disposable, so an upgrade that goes wrong costs you slower builds while it refills, not lost work.
• Watch the repository's releases on GitHub. It is the one notice channel, and you can stop at any time. We do not collect email.

What we sign and publish

Releases are built only in CI. Each one comes with files you can check without an account:

• Container images, signed without a stored key (Sigstore), with build provenance.
• checksums.txt with its own signature file.
• A software bill of materials (SBOM) for each binary archive.
• A VEX file saying which known vulnerabilities do and do not affect the release.
• A release-manifest.json listing every file and its digest.

The commands are under "Verifying a release" in RELEASING.md. See also how we build.

The current release's images are scanned again every day, so a vulnerability disclosed against something we already shipped raises an issue.

What the server does with your data

The server sends no telemetry and needs no connection to FosterStack: no usage reporting, no licence check, no update ping. It stores what your build tool sends it, which is cache keys and the files they point to. You can check that it makes no outbound connections, and the command is in the security policy on GitHub.

This website has no forms, no cookies, no analytics and no third-party requests.

What we do not claim

• The server has a read-write login and an optional read-only login. There is no per-person identity.
• The paid tiers are not built.
• We are not announcing an LTS line, a support period, or a date.

Machine-readable contact: security.txt.