# Security Policy

`mgf-cloud` is a federation sibling of [`mgf-common`](https://codeberg.org/magogi-admin/mgf-common),
the provider-agnostic interface the federation uses to create and
manage cloud VMs and storage (Infomaniak Public Cloud / OpenStack
first, AWS-ready). It manages **live, billable infrastructure** and
**handles cloud credentials**, so we take security reports seriously.

## Supported versions

In the 0.x window, **only the latest MINOR receives security
patches.** Per [SemVer 0.x](https://semver.org/#spec-item-4) and
rule **AP-03** from `mgf-standard/docs/standards/API_DESIGN.md`,
each MINOR release MAY break the public API; we do not
branch-and-backport across minors. Security fixes ship as the
next PATCH on the latest MINOR.

| Version | Supported |
|---------|-----------|
| `0.1.x`  | ✅ — latest MINOR; security patches ship as `0.1.Y` |
| `< 0.1`  | ❌ — pre-publish development; upgrade to `0.1.x` |

When a security fix lands, the [`CHANGELOG.md`](CHANGELOG.md)
entry for the fixing release names the affected versions and
the upgrade path.

## A note on credentials

`mgf-cloud` reads cloud credentials (OpenStack Application
Credentials, EC2/S3 keys) **only** from the standard sources — a
`clouds.yaml` file, the `OS_*` environment, or a token/clouds file
under `my_stuff/` (gitignored per AG-18). Credentials are **never
logged**, never serialised into errors or tracebacks, and never
surfaced in the local web GUI. Outbound TLS verification stays on.
See [`docs/design/DESIGN.md`](docs/design/DESIGN.md) §5 + §10 for the
full credential + guardrail model.

## Reporting a vulnerability

**Please do not open a public issue or pull request** until we have
had a chance to triage and patch.

To report a vulnerability privately, choose one of:

- **Email:** `bassam@magogi.org` with subject prefix
  `[mgf-cloud security]`.
- **Codeberg private security advisory:** open a private
  vulnerability report via
  [the repository's Security tab](https://codeberg.org/magogi-admin/mgf-cloud/security).

### What to include

- A description of the vulnerability and its impact.
- Steps to reproduce — a minimal failing test or shell transcript
  is ideal.
- The version(s) of `mgf-cloud` affected, plus the pinned
  `mgf-common` version and any relevant provider-SDK extra
  (`openstacksdk`, `boto3`, `paramiko`).
- Python version + OS.
- Any suggested mitigations or patches you have in mind.

### What to expect

| Stage | Timeline |
|---|---|
| Acknowledgement | within 3 business days |
| Initial assessment + severity rating | within 7 business days |
| Patch + release | within 30 days for high-severity, 90 days for medium |
| Credit + public disclosure | coordinated with the reporter |

We follow a **90-day default embargo**, extendable by mutual
agreement if a patch is not yet ready. After the embargo expires
(or after a patch ships, whichever is first), the vulnerability is
disclosed in the [`CHANGELOG.md`](CHANGELOG.md) entry for the
fixing release, with credit to the reporter unless declined.

## Scope

**In scope:**

- Code in `src/mgf/cloud/` (the published `mgf-cloud` package) —
  the provider abstraction, the adapters, the CLI, and the local
  web GUI.
- Credential handling, secret-logging, and the create/delete
  guardrails (`--yes`/confirm, `--dry-run`, TLS verification,
  localhost-only web bind).
- Build / release infrastructure (`pyproject.toml`, the manual
  release flow specified in
  [`mgf-standard/docs/standards/RELEASING.md`](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/docs/standards/RELEASING.md)).

**Out of scope:**

- Vulnerabilities in `mgf-common` itself — report to
  [`mgf-common/SECURITY.md`](https://codeberg.org/magogi-admin/mgf-common/src/branch/main/SECURITY.md).
- Vulnerabilities in the underlying provider SDKs (`openstacksdk`,
  `boto3`, `paramiko`) or the web stack (`fastapi`, `uvicorn`,
  `jinja2`) — report to the upstream project; we bump pins as soon
  as a patched release is available.
- Vulnerabilities in the cloud provider's own platform
  (Infomaniak Public Cloud / OpenStack / AWS) — report to the
  provider.
- Self-inflicted exposure (e.g., binding the web GUI to a public
  interface against its design, committing `clouds.yaml` to a
  repo, or disabling TLS verification).

## Hardening recommendations for consumers

Consumers of `mgf-cloud` adopt the
[`mgf-standard/docs/standards/SECURITY_STANDARD.md`](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/docs/standards/SECURITY_STANDARD.md)
engineering standard as their baseline. The Rules box at the top
of that document is the bar; the §15 mechanical-enforcement matrix
is the contract for what every consumer's CI should check. Because
`mgf-cloud` provisions live infrastructure, treat its credentials
as production secrets: keep `clouds.yaml`/EC2 keys out of version
control, scope OpenStack Application Credentials to the minimum
project access, and run mutating commands behind `--dry-run` first.

## A note on the standards

`mgf-cloud` is a **federation sibling** under the project-shape
taxonomy from
[`mgf-standard/docs/standards/DOCUMENTATION.md`](https://codeberg.org/magogi-admin/mgf-standard/src/branch/main/docs/standards/DOCUMENTATION.md) §2.0.
The cross-project engineering standards live in `mgf-common`; this
project inherits them. See [`docs/standards/README.md`](docs/standards/README.md)
for the pointer.
