Security

Ferro is designed with security as a priority. This page summarizes the security features and policies. For the full security policy, see SECURITY.md in the repository.

Reporting Vulnerabilities

MethodDetails
Emailsecurity@wyatt.au (PGP encrypted)
GitHubSecurity Advisories

Response Timeline

SeverityInitial ResponsePatch Release
Critical (RCE, auth bypass)24 hours72 hours
High (data exposure, privilege escalation)48 hours7 days
Medium (CSRF, XSS, information disclosure)72 hours14 days
Low (best practices, minor issues)1 weekNext release

Security Features

Authentication

MethodDescription
Simple authHTTP Basic Auth with bcrypt-hashed passwords (cost factor 12)
OIDCOpenID Connect with PKCE flow (Keycloak, Auth0, Google, etc.)
LDAPLDAP authentication (behind ldap feature flag)
AuthorizationCedar policy engine for fine-grained access control

Encryption

LayerImplementation
TransportTLS 1.3 (rustls)
File E2Eage (X25519, ChaCha20-Poly1305)
Passwordsbcrypt (cost factor 12)
TokensHMAC-SHA256
ComparisonConstant-time for secrets

Input Validation

  • Path traversal prevention (normalized paths, .. rejection)
  • Content-Type validation on uploads
  • Request body size limits (configurable, default 1 GB)
  • XML entity expansion prevention in WebDAV

Security Headers

HeaderValue
Strict-Transport-Securitymax-age=31536000; includeSubDomains
X-Content-Type-Optionsnosniff
X-Frame-OptionsDENY
Content-Security-PolicyConfigurable
X-Request-IDUnique per request (audit trail)

Federation Security

  • HTTP Signatures (draft-cavage-http-signatures-12)
  • HMAC-SHA256 verification
  • Actor keyId validation (must match activity actor)
  • Empty federation secret = disabled (503)

Rate Limiting

  • Per-IP token-bucket rate limiter
  • Default: 10,000 requests per 60-second window
  • Returns 429 Too Many Requests when exceeded

Deployment Security

  • Non-root containers where supported
  • no-new-privileges security option
  • cap-drop: ALL with minimal capabilities
  • Resource limits on all containers
  • Health checks on all services
  • No secrets in configuration files

Audit Logging

Ferro tracks all file operations in an audit log. Access via:

curl http://localhost:8080/api/audit?limit=50 \
  -H "Authorization: Bearer TOKEN"

Supported Versions

VersionSupported
2.xYes
< 2.0No

Dependency Security

  • Weekly cargo audit (automated in CI)
  • Monthly manual review of new dependencies
  • No dependencies with known critical CVEs
  • Prefer pure-Rust implementations over C bindings

Penetration Testing

Ferro is designed to be pen-testable. See SECURITY.md for the full penetration testing guide including test cases for authentication bypass, path traversal, XML injection, federation spoofing, and more.