Jean-Pierre MartineauandClaude Opus 5
628b665420
The rest of the community files, which are the half of open-sourcing that is not code: how someone tells you about a hole, what happens if a thread turns nasty, and what you will be asked when they file a bug. SECURITY.md points at GitHub's private vulnerability reporting rather than an address that will be scraped, and promises only what one person in his spare time can keep — an acknowledgement inside a week, which is not a fix inside a week, and a decision inside ninety days. Its scope section is the MeshTerm-specific part: a channel key or an admin password reaching a log, an export or the screen is a vulnerability here, a crafted packet corrupting the observation database is one, and a hole in the MeshCore firmware or in `bleak` is somebody else's to fix. It also says plainly that the database is not encrypted, because a backup of it carries a mesh's whole history. The code of conduct is Contributor Covenant 2.1, taken verbatim from source rather than paraphrased, with a real address in the enforcement section. The bug form asks the seven things that otherwise get asked in every thread: version, flavour, transport, OS and Python, terminal and its size, companion firmware. Flavour is there because the PicoCalc draws itself in 53 columns and sixteen colours, so a layout bug in one flavour frequently does not exist in the other. It asks for the version from the splash screen rather than from `meshterm --version`, which does not exist yet. Dependabot is weekly and capped low, with minor and patch grouped into one pull request: a solo maintainer facing five dependency PRs every Monday stops reading any of them. Funding points at the three destinations the app's own support page already offers, so the two cannot drift. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2.6 KiB
Security policy
Reporting a vulnerability
Use GitHub's private vulnerability reporting: go to the Security tab of this repository and choose Report a vulnerability. That opens a private thread visible only to you and the maintainer, so nothing is disclosed while it is being fixed.
If that is unavailable to you for any reason, email johnputer@meshterm.net instead.
Please do not open a public issue for a security problem.
What to expect
MeshTerm is maintained by one person in his spare time, so this promises only what can actually be kept:
- An acknowledgement within a week. Not a fix within a week — an answer saying the report was read and what happens next.
- A fix or a decision within 90 days for anything confirmed. If it will take longer, you will be told why.
- Credit in the release notes, unless you would rather not be named.
A slow reply is not a dismissal. If a week passes with silence, a nudge on the same thread is welcome.
Supported versions
While the major version is 0, only the latest release is supported. There are no
backports; a fix ships in the next version.
Scope
In scope — anything in this repository:
- Code execution, path traversal, or file overwrite triggered by data MeshTerm reads: packets overheard from the mesh, a companion's responses, a config or preferences file, a downloaded map tile.
- Anything that discloses a channel key, a repeater admin password, or a node's private key material — including into the local database, a log, an export, or the screen when it should not be there.
- Anything that lets a crafted packet corrupt or delete the observation database.
- Weaknesses in how MeshTerm stores credentials on disk.
Out of scope, though still worth telling us about somewhere:
- Vulnerabilities in the MeshCore firmware or in the companion device itself. Those belong upstream at the MeshCore project.
- Vulnerabilities in the
meshcorePython library,bleak, or any other dependency — report those to their maintainers. If a MeshTerm change can mitigate one, we want to know. - The fact that anyone within radio range can hear a public channel. That is how a mesh works, not a defect.
- Anything requiring an attacker to already have write access to your filesystem or your companion device.
A note on what MeshTerm handles
MeshTerm decrypts channel traffic using keys you give it, and it records everything it overhears to a local SQLite database. That database is not encrypted. Treat it as you would any file holding your mesh's history, and remember that a backup of it carries the same weight.