Do not open public GitHub issues for security concerns. Instead, report a vulnerability on GitHub. This will be visible to the maintainers but not the general public.
We use coordinated disclosure. We work privately with you to validate and fix the issue before public disclosure. Once a fix is available for supported versions, we publish a security advisory on this repository.
- Social engineering or phishing attacks
- Physical attacks
- Denial-of-service attacks
- Reports produced solely by automated scanners without a demonstrated, exploitable impact
- Third-party services and dependencies not maintained by Firezone
We support the latest released version of sanstun.
Security fixes are delivered in a new release.
We do not backport patches to older versions.