# Security policy

**English** · [Português](SECURITY.pt-BR.md)

Acauã is defensive software, but it processes hostile input: packet captures,
Zeek logs and flow records may be malformed on purpose. Treat every dataset as
untrusted.

## Reporting a vulnerability

Do not open a public issue with exploit details. Open a minimal issue asking for
a private channel, or contact the maintainer through the Gitea profile listed on
the repository. Include the affected version, the input shape and a minimal
reproduction when a private channel is available.

## Scope and threat model

- **Input parsing:** a malformed log line must not panic the daemon, exhaust
  memory or escape the configured data directory.
- **Path handling:** dataset paths are resolved and confined to the configured
  root; symbolic links are not followed outside it.
- **API exposure:** `serve` binds to `127.0.0.1` by default. Exposing it on a
  network interface is an explicit operator decision and needs a reverse proxy
  with authentication.
- **Evidence integrity:** alert evidence must be reproducible from the same
  input and code version. Silent nondeterminism is a correctness and security
  issue.
- **Updates:** the CLI checks Gitea Releases, downloads over HTTPS and verifies
  SHA-256 before replacing the binary. The desktop app does not update itself.
- **Privacy:** there is no telemetry. Retention defaults to seven days of
  normalized events; the operator is responsible for local law and policy.

## Out of scope

- Vulnerabilities in third-party Zeek, Suricata, Tauri or operating-system
  packages that are already fixed upstream.
- Attacks that require the operator to disable the documented security controls
  (for example, running `serve` as root on a public interface).
- Detection quality claims: the pillars are not implemented in this skeleton.

## Supported versions

Only the latest `0.1.x` line is supported while the project is pre-alpha. There
is no long-term support branch yet.