# Security Policy

## Supported Versions

Only the latest release on the `main` branch is supported with security
updates. We do not backport fixes to older versions.

| Branch | Supported |
|--------|-----------|
| `main` | Yes       |
| Other  | No        |

## Reporting a Vulnerability

**Please do not open a public issue for security vulnerabilities.**

Use GitHub's private vulnerability reporting to submit a report:

1. Go to the [Security tab](https://github.com/jasonherald/sdr-rtltcp-discovery/security)
2. Click **"Report a vulnerability"**
3. Provide a description, steps to reproduce, and any relevant details

### Alternative reporting

If you cannot use GitHub's private reporting, email **security@aaru.network**
with a description, steps to reproduce, and any relevant details.

### What to expect

- **Acknowledgment** within 48 hours
- **Assessment** of severity and impact within 1 week
- **Fix or mitigation** as soon as practical, depending on severity
- **Disclosure** 90 days after the fix is released, or immediately if the
  vulnerability is already public
- Credit in the fix commit (unless you prefer to remain anonymous)

## Security Scanning

This crate uses automated security scanning in CI:

| Tool | Integration | Coverage |
|------|-------------|----------|
| [cargo-audit](https://rustsec.org/) | GitHub Actions (PR + weekly) | Known CVEs in Rust dependencies (RustSec advisory database) |
| [cargo-deny](https://embarkstudios.github.io/cargo-deny/) | GitHub Actions (PR + weekly) | License compliance, duplicate-crate detection (warn-only), source restrictions |
| [CodeQL](https://codeql.github.com/) | GitHub Actions (PR + weekly) | Static analysis of GitHub Actions workflows |
| [Dependabot](https://docs.github.com/code-security/dependabot) | GitHub-native (weekly) | Automated dependency-update PRs for Cargo + GitHub Actions |

## Scope

This crate is an mDNS/DNS-SD discovery helper for `rtl_tcp`-compatible
servers (the `_rtl_tcp._tcp.local.` service type). It:

- Registers and browses mDNS service records on the local network via the
  pure-Rust [`mdns-sd`](https://docs.rs/mdns-sd) crate (no Avahi/Bonjour)
- Parses TXT-record payloads from advertisements into typed structs
- Reads the local system hostname (`gethostname(3)` on Unix)

Vulnerabilities in TXT-record parsing, mDNS service-name handling, or the
hostname-lookup path are in scope.

### Out of scope

- Vulnerabilities in `mdns-sd` itself — report upstream
- Bugs in the `rtl_tcp` protocol or any specific server/client implementation
  that *uses* this discovery layer
- Denial of service via a flood of mDNS traffic on the local segment
  (an inherent property of mDNS, not specific to this crate)
- Issues requiring an attacker already on the local network segment *and*
  privileged enough to spoof multicast — the threat model assumes a
  trusted LAN, same as every other mDNS consumer
- Vulnerabilities in system libraries (libc, the OS resolver) — report
  upstream
