Security

Reporting a vulnerability#

Use GitHub’s private vulnerability reporting on the repository (the Security tab, then Report a vulnerability). Do not open a public issue. Include the version (svavyom-ctl version), what you did, what you expected and what happened.

Never include passwords, session cookies, console tickets, private keys or a support bundle that you have not read through.

Report privately on GitHub

What to expect of the product#

• Release artifacts are not signed yet; verify them against the published SHA256SUMS over a channel you trust.
• The web console uses HTTPS with a self-signed certificate unless you install your own.
• Passing scanners and tests reduce known risk; they do not prove safety.

Scope#

In scope: the services in the repository (backend/, frontend/, packages/) and the installer. Out of scope: vulnerabilities in QEMU, libvirt, the guest operating systems you run, or your own network.