Skip to content

Add security policy and CodeQL badge to documentation #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aartinian merged 1 commit into from
Nov 1, 2026
Merged

Add security policy and CodeQL badge to documentation #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

<p align="center">
<a href="https://github.com/aartinian/cvpnctl/actions/workflows/ci.yaml"><img src="https://github.com/aartinian/cvpnctl/actions/workflows/ci.yaml/badge.svg" alt="CI"></a>
<a href="https://github.com/aartinian/cvpnctl/actions/workflows/github-code-scanning/codeql"><img src="https://github.com/aartinian/cvpnctl/actions/workflows/github-code-scanning/codeql/badge.svg" alt="CodeQL"></a>
<a href="https://github.com/aartinian/cvpnctl/releases"><img src="https://img.shields.io/github/v/release/aartinian/cvpnctl" alt="Release"></a>
<a href="go.mod"><img src="https://img.shields.io/github/go-mod/go-version/aartinian/cvpnctl" alt="Go"></a>
<a href="LICENSE"><img src="https://img.shields.io/github/license/aartinian/cvpnctl" alt="License"></a>
Expand Down Expand Up @@ -223,6 +224,10 @@ You can also give it a passphrase. EasyRSA then asks for it on every `create`, `
easyrsa set-pass ca
```

## Security

Found a security problem? Please report it privately rather than in an issue; [SECURITY.md](SECURITY.md) says how, and what cvpnctl can and can't protect.

## Development

```
Expand Down
18 changes: 18 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# Security

cvpnctl handles your CA's private key and every user's key, so if you find a security problem, I'd really like to hear about it.

## Reporting

Please report it privately rather than in a public issue: on GitHub, use [Report a vulnerability](https://github.com/aartinian/cvpnctl/security/advisories/new). A short description and the steps to reproduce it are plenty; just leave out real account or endpoint IDs.

This is a one-person project, so give me a few days to reply. Fixes go into the next release, and I'm happy to credit you in the advisory. Only the latest release is supported, so please check that the problem is still there with it.

## Good to know

cvpnctl tries hard to keep keys safe: they're written with private file permissions, in S3 mode they only live in a temporary folder that's deleted afterwards, and an older copy of the shared PKI can never overwrite a newer one. A few things are outside its control, though:

- **The CA key** is what everything depends on: whoever has it can issue certificates your VPN accepts. Keep it on an encrypted disk, or in S3 behind tight IAM and KMS permissions ([docs/iam.md](docs/iam.md)).
- **Your machine and AWS credentials:** anyone who controls them can do whatever cvpnctl can.
- **Download links** give access to a user's private key until they expire, so send them straight to that user. `cvpnctl link` or `revoke` makes an old link stop working.
- **EasyRSA, OpenSSL, OpenVPN and AWS** have their own security processes; please report issues in those upstream.
Loading