SecurityReport a vulnerability
Security

Reporting a vulnerability

Report a security problem in private through a GitHub security advisory.

Markdown

Report security problems in private. Turmite uses GitHub private vulnerability reports on loruorg/turmite.

How to report

  1. Open github.com/loruorg/turmite/security/advisories/new.
  2. Write a short title and a description.
  3. Submit the report. Only the maintainers can see it.

You need a GitHub account. The same address is in /.well-known/security.txt.

Do not open a public issue, pull request or discussion for a security problem. Do not post it in a chat or on social media before a fix is released.

What to include

  • The Turmite version (turmite version) and the install method.
  • The mode: mainnet or testnet.
  • The affected component: merchant API, checkout, dashboard, worker, EVM contracts, SDK, WooCommerce plugin, install.sh or this site.
  • The steps to reproduce the problem, with requests and responses if you have them.
  • The impact: what an attacker can do, and what access the attacker needs first.
  • A proposed fix, if you have one.

Remove real API keys, secrets, private keys and customer data from the report.

Scope

In scope:

  • The code in the loruorg/turmite repository.
  • The container image ghcr.io/loruorg/turmite.
  • The EVM deposit contracts in contracts/.
  • @turmite/sdk and the WooCommerce plugin.
  • The install script at https://turmite.com/install.sh.
  • The site turmite.com.

Out of scope:

  • Problems that need full control of the server first. See Threat model for what such an attacker can already do.
  • Misconfiguration of a single install, for example a public dashboard without two-factor authentication.
  • Third-party software and services: PostgreSQL, Caddy, Docker, RPC nodes, Trocador and the exchanges it lists. Report these to their maintainers.
  • Denial of service by traffic volume.

What happens next

  1. A maintainer acknowledges the report.
  2. The maintainers confirm the problem and agree on a severity with you.
  3. The maintainers prepare a fix in a private fork of the advisory.
  4. A new release ships the fix. The advisory is published at the same time, with credit to you if you want it.

Turmite is a community project. There is no bug bounty.

How fixes reach operators

Each install reads the releases and security advisories of loruorg/turmite on GitHub once a day, unless an admin turned the check off. When an advisory affects the running version, admins see a red banner in the dashboard. When SMTP is set, admins also get an email for each critical or high advisory. To install the fix, follow Upgrades.

Without a running install, watch the releases of the repository on GitHub (Watch, Custom, Releases) and read the advisories.