Security Policy & Advisories
Vulnerability disclosure procedures, security mechanisms, and supported version matrices.
Supported Release Versions#
| Version | Supported | Patch Cadence |
|---|---|---|
| Latest 1.3.x release | Yes | Immediate security patches & hotfixes |
| master branch | Yes | Continuous rolling security updates |
| Older 1.x releases | Best Effort | Supported until the next minor release |
| Pre-1.0 tags | No | Unsupported legacy releases |
Reporting a Vulnerability#
If you discover a security vulnerability in SolarFlare, please do not open a public issue.
Submit a confidential report via GitHub Private Security Advisory.
Reports are triaged promptly by the maintainer.
Security Architecture & Defenses#
- Scoped API Tokens: Fine-grained permission model prevents external automation from accessing arbitrary administrative operations.
- CSRF Token Validation: State-changing browser requests require valid
X-CSRF-Tokenheaders. - Signed Webhooks: Outgoing webhook payloads carry HMAC-SHA256 signatures (
X-Solarflare-Signature). - Encrypted Local Stream: RTSP and video/audio channels are encrypted with TLS and AES-128-GCM.
Hardening checklist#
| Priority | Action |
|---|---|
| High | Strong Web UI password; never keep defaults |
| High | Keep origin_web_ui_allowed at lan or pc |
| High | Never expose port 47990 to the Internet without a hardened reverse proxy |
| Medium | Scoped Bearer tokens instead of admin Basic in automation |
| Medium | webhook_secret set; receivers verify HMAC signatures |
| Medium | trusted_subnet_auto_pairing disabled unless strictly needed |
| Medium | CA-signed TLS cert when browsers reach the UI remotely |
| Low | Prune csrf_allowed_origins and unused paired clients |
Mechanisms in depth#
The origin gate (pc loopback-only, lan private/local default, wan anywhere) runs before authentication: outsiders get bare HTTP 403. Both listeners (GameStream port default 47989, Web UI port +1) share the configured cert/pkey; Moonlight pins the cert at pairing, so a key change forces re-pairing and a pre-pairing MITM is the residual risk. Passwords are salted SHA-256; API tokens are 64-char hex stored as SHA-256(token:salt). Browsers need X-CSRF-Token on state-changing calls (same-origin and allowlisted origins skip it; curl without Origin/Referer is exempt). Trusted-subnet auto-pairing silently pairs matching CIDRs — keep ranges tight. Webhooks accept https only, retry twice, and sign with X-Solarflare-Signature when a secret is set. The GameStream HTTPS handshake pool is capped at 64 concurrent to blunt slow-handshake DoS. GET /api/browse exposes host paths to the process user, so combine auth, origin policy, and OS permissions.
Fixes, versions & disclosure#
No LTS branches and no backports: fixes land on master and ride the next tag. Confirm patch state with both the installed package version and GET /api/health version. Pre-tag fixes: pull master, rebuild or re-run linux-install.sh, re-check /api/health. Monitor both SolarFlare and upstream Sunshine advisories for inherited components (OpenSSL, FFmpeg, libcurl). Reports: affected version/commit, component, reproducer, impact, optional fix — expect acknowledgement in about 7 days, a fix on master, a changelog entry, and a published advisory when impact warrants it.