# Security Policy

## Supported Versions

4.x versions are supported with critical and security bug fixes.

| Version | Supported          |
| ------- | ------------------ |
| 4.3.x   | :white_check_mark: |
| 4.2.x   | :white_check_mark: |
| 4.1.x   | :white_check_mark: |
| 4.0.x   | :white_check_mark: |
| < 4.0   | :x:                |

## Reporting a Vulnerability

If you believe a bug you found could have security implications,
please send a GPG encrypted email with the details to the maintainers:

| Maintainer | Email address   | GPG fingerprint |
| ---------- | --------------- | --------------- |
| Doron Somech | somdoron@gmail.com | E0B0 E3D1 55DD 6ED6 71FB  2B79 D0B9 CC44 867D 8F3D |
| Luca Boccassi | luca.boccassi@gmail.com | A9EA 9081 724F FAE0 484C 35A1 A81C EA22 BC8C 7E2E |

## Internal severity classification

We will attempt to follow this general policy when assigning a severity to
security issues. These are guidelines more than rules, and as such end
results might vary.


| Severity | Definition |
| -------- | ---------- |
| CRITICAL | endpoints using STRONG authentication are SILENTLY affected |
| HIGH | endpoints using STRONG authentication are VISIBLY affected |
| MODERATE | endpoints NOT using STRONG authentication are SILENTLY affected |
| LOW | endpoints NOT using STRONG authentication are VISIBLY affected |

STRONG authentication means transports that use cryptography, for example CURVE
and TLS.

VISIBLY affected means that platform owners are likely to immediately notice
misbehaviours, like crashes or loss of connectivity for legitimate peers.

SILENTLY affected means that without close inspection, platform owners are
unlikely to notice misbehaviours, like remote code executions or data exfiltration.

### Public keys
<details>
<summary>Doron Somech</summary>

```
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBF0YXO8BEAD8Be6QQa+ALzIWszeDPtVK9DCGN7ZM1C4Ygq6w7llauhg4wreg
kQy7YwOFKsFTi9cmIRfkw/lX9tIn+PkNe+kV7tOLDCdAmNCqdERvM/C46uPM/Mx4
IdaoUXOPVIwbLcCLysiYxickq/M6ymPH7pAT5deCxH9B1DV38T2Mlq+uXXyZ1aFE
74oCouQ7Vau31NBeOA4DkpPjpdA/WXMVEqoB3PKALUGYs1Ce5CguE0WjdueZFt2k
DvdYtbUFb+vNLMPCejf1sBWDnUygPfsPPakyimfxBSIRsQLvw/5t6bkiWgtGU4LD
o37skSzum7h0rw1378ryoMUYdaNu/oNlWCwbQzBjD6G+WYbmu5AB5aGSaDjUzg9K
AIcaNbRFln7OwvHrQdvDuWypZw7JvWYbehaywBagbjSTjIwb+Umki8cF/zxi5sxI
eFRMARDVQa5PAeErDd+4RtMcB55M2a90xWcTcfBdE/VYmwBXsMMWju4ceBtAqBCB
DTVxxaT54tKjkOKa1Yk75zL4Xu7Sekg2BIaHh/qVMn5aTEX+X6ImeFhWRjhgsk+Q
XoXo74nJq2aCJ2sSjLRdvnePtc3WM+WfdmdnC12JpBiBn4TFYxMBJlvqfKBxZELU
eZBkB6eTcBO/n5U3jSdFM47SeiBgUlPRiV+0ArZJ4i2Giv9vduWO6XeMVwARAQAB
tCFEb3JvbiBTb21lY2ggPHNvbWRvcm9uQGdtYWlsLmNvbT6JAjgEEwECACIFAl0Y
XO8CGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENC5zESGfY89i0wP/i5k
sYQkdaPeos9JnfUd3cV588lQzBN2bVhzCtbrjR6wXn9hRhZP9ftCNKoVp8cpC07G
Vq87sKqeB7odaK67jS+XoF4msIUEYS0lN2lPORf523VK3Juy9FW39aEPfx+6P5+h
h49VveR1t9I7MgdjnKVwmaELcFDKKGQaPlcWlKctSkOLRw/vYFIvajFJ30bkK9+z
sjgtUvXbSgt4HHHOQ/M6oCNhDsY0YE1zNxDgc8EqRlRxf76+pwldMe47/sIP2U7m
qI6d/LfsWnK6iJ0ehlp6oPP2GcUM8bH3lh2ugHH7sPSwpvh/rHqQTTxv+KiFeQOC
yuxvWdjathnDDHRNPVahBR747iKlcebJeaK5X8wObcIDaGBecwnNIjws4hrYAFH0
eNiROIbDkxDjwFhBYLDMfVCPW3xpBDa67EBJ6qTrabxmXOGvUDR2kB0P5lmtU/jL
jdVeFLj9tgwuuL8PW5k/gCdeB4WSBF4VWAHBZ2vDXUPut78dHQQg+dgvHmbnRYZB
Em6nrYUeoQ4nSOHf7VmdHf05HGwam+ZTWLN2sIEerNJlRCx6mEn20O2S7DE4RMi5
VjBFHy8/YSR3hRtdOSYfE61AeProeDPTGiei6xxlN00MQ7K/kFhQHIjKz1Ao51LU
o6+KGTtka2+g368boLcQALIchlfp7cfUAEp+dB7UuQINBF0YXO8BEADBXhwad2VN
XFhD69CPwWR39KmoW019EvT8tNWzCPzx8hQeTJz+fY0bTiXYxMROZwF0SD4kqYet
nejfH+boUFV64coxmfCmriqOQ0SGZTCfWzrjDrWjj51Xe1NWsGnFNO6vCcL1NNPB
0ZcE/wskEaKPi6Ui0SwvlDJQFK5UnrnFehmEIxEqi8BFez2Ft7/3I/XRrhlDzMtT
hDgMb+Ro9BydddH3TRKAdJBzIsozCrv0nn1DIXM+Pocqiuvk72E6iUxS2meeA4F6
DTG6MIWEcf6WPRVqXdD2bCBzDJ1NYixK9TFdZjo/6jTLwwX711+/NTIblAbpc/KE
io+0cuRG99gP8Cr+1VVZ2fcK9FpjI/u4YERmj8arMkcFz+QQDaJnXIjmNDpD0zBQ
Dh2v6pKysoEgmOE2xDzBsJbZomluKOytLN9/KcqucB1qkjzHD5JeZe+/S1vxdZUn
+81Us+SeepiDOfrT84xFYcqJentL+ylFj7zBdeqF4WTnZAT9/xbVuUSYnRm1Sm0z
vr99Sum0MXUTzgNhY5x3PkFQyg91lllJUFGoXiLivG+3M8JFC7V2K7wXhHFqffVX
Qq6UOm6+kCTjUCgzpQswMpDremB7A2fBQObKOC/3pE0Gbh3uKvylqQkMPTn4lOao
J3VSd1hBqHAdb5uxnmxN8w3wIpnaSypBawARAQABiQIfBBgBAgAJBQJdGFzvAhsM
AAoJENC5zESGfY895WkQAJYvJg/IYBKh0SblT8lGj9O+mLXO6K1q+HfZ6mERm9Ew
+fgW/cwGzuUrn+DC6vfsXlqtshUwiaxaa6NJccPBfC5IGHAegK5giwnQ/sbrA70A
7md2u+NK2tNDGK4Gxy8ZWMY1++TmwdVLzNivM5IA/NGotyYgQStDI+/Muvh+0wQ9
xZjo/InxVXeQcnqQXVKhoouPo2GlXslHev04SRl/ZJYN5sEHCE0Qx6L++esVvrwE
/N5NT5Rk41l4mXAN2SM0H5AB+Wf1qIiVB6pMLBzXM/7qnCnJS0FZZjf2WRiB0yXj
xTl+/JUK9MYckkrNcAfnb6yvnvO5W3KDabZhl/Cqw08vVSvcqyYRFXIa4vduiGJP
L6C8o3USbjVfZhBSHXpuo7JPzR0S4l52QB2ZnTCRIjSBe5vphVum6r3vR5rKAU1n
Htytqm099TlDapj+4wixSv8TvwlJr9no0uEJloyRAMFMYms4KgLEEZfc2tqpe/sA
nO6TM9h/hCbrImplSiesHqTxprnKAipudSYkc750zuFTiBQ5WwYbWjkCB2PSEh+l
8ZCRM5Ropfk4ATMhXH/w2Dxa5mdaHuKWKUc14+YfSBJI8yohbVIzYVsvAclctCQY
kAh/Z/Fl8W+ftDsZF0/1k3fxyKwExFej+AIsabcQDG0bAHscfH/44atKZRPn72FI
=Qu19
-----END PGP PUBLIC KEY BLOCK-----
```

</details>

<details>
<summary>Luca Boccassi</summary>

```
-----BEGIN PGP PUBLIC KEY BLOCK-----

[encoded data, 13065 characters]
XNBso9Rw94Z5NVIXEcH3O44UsWI=
=AXgM
-----END PGP PUBLIC KEY BLOCK-----
```

</details>
