Security policy

Reporting a vulnerability

Send suspected vulnerabilities to stefano@dragas.it. Do not open a public issue, do not include real user data, and do not test against an instance you do not operate.

Include:

• The affected version.
• The configuration and backend in use.
• Reproduction steps.
• The impact, as you see it.
• Any mitigation you would suggest.

Encrypt an especially sensitive report before sending it, and ask for a public key in a first message.

Severity and complexity can move those timelines. If they move, you will hear about it rather than guess.

Supported versions

Until the first stable production release, only the latest tagged release is supported. After a stable release, the newest release line receives security fixes, and older versions may be asked to upgrade before a fix is prepared.

What is the operator's job

The address above is for defects in littleFedi. It is not for moderation disputes on a particular instance, and it cannot be: I have no access to your server and no standing over your community.

Every operator is responsible for publishing their own security and abuse contact. The instance profile has a field for it, and it appears on /about and through the instance APIs so people can actually find it.

The littleMesh trust model

littleMesh changes who can see your traffic, so it gets its own section rather than a footnote.

A node is named by its own key

Reaching a node ID means reaching the holder of that key, or failing. There is no certificate authority in the path.

A lighthouse relays ciphertext

It cannot read, alter or impersonate the nodes it connects. It can refuse to carry traffic, and it can observe which node IDs talk to each other and when. littleMesh addresses reachability, not anonymity.

The HTTPS gateway is the exception

It is opt-in for the relay operator, and it terminates TLS for callers who are not mesh members. Its operator can read that traffic, tamper with GET responses, and drop requests. Signed POSTs cannot be altered undetected. Mesh peers never traverse the gateway. Operators who trust no relay should set mesh.suffix = "mesh" and forgo interoperability with the ordinary fediverse.

The mesh private key is the instance's identity

The key in the mesh_identity table is not a credential you can reissue. Protect and back it up exactly like the ActivityPub actor keys.

The directory is not a trust anchor

It can assign and resolve a readable alias and serve signed lighthouse locators. Every record is verified against the node ID, and every payload connection still pins it. A compromised directory can censor discovery or deceive the first lookup of a human alias; it cannot impersonate a node ID a caller already knows. Client processes sharing one database use monotonic upserts and never replace a higher observed sequence with a lower one. Public directories default to node-bound alias reservations and a hard record cap.

Security posture of the server

• Every configuration secret has an environment-variable form, so nothing sensitive has to live in the TOML or in a process argument.
• SMTP verifies the certificate chain and the hostname in both STARTTLS and implicit TLS modes. Turning that off is possible, logs a warning at every startup, and is documented as a temporary escape hatch for a trusted private relay.
• Administrator MFA can be required, and the requirement is checked on the web interface, the admin console, the API, OAuth and streaming.
• Custom CSS is inlined into a <style> element, so the two sequences that could close it early are rejected outright. That boundary is enforced on save and again on import.
• Owned media uses unguessable bearer URLs, the same model Mastodon uses. Anyone who obtains such a URL can fetch that file, which is a deliberate trade for federated rendering, and is stated in the media documentation rather than buried.
• Static-analysis review runs in CI against a recorded baseline.