Ferrum Edge is pre-release. Cargo.toml declares version 0.9.0 and no v* release tag has been cut yet, so there is no released line to support and no previous minor to fall back to.

Until the first v* tag, run a pinned build from main and update it to take a security fix; there is no backport target. The support window per minor, the deprecation notice period, and the security-fix backport policy that will apply from 1.0 are in docs/support_policy.md — the values there are proposed until that first tag.

We take security vulnerabilities seriously. If you discover a security issue in Ferrum Edge, please report it responsibly.

Please do not open public GitHub issues for security vulnerabilities.

Instead, send an email to: contact@ferrumedge.com

Include the following information:

• Description of the vulnerability
• Steps to reproduce (if applicable)
• Potential impact
• Suggested fix (if you have one)
• Your contact information for follow-up

• Acknowledgment: Within 48 hours of receiving your report
• Initial assessment: Within 5 business days
• Fix timeline: Depends on severity and complexity
  • Critical: 7 days target
  • High: 30 days target
  • Medium: 90 days target
• Disclosure: Coordinated with reporter, typically after fix is released

• We will confirm receipt of your vulnerability report
• We will assess the severity and impact
• We will work on a fix and may ask for additional information
• We will credit you in the security advisory (unless you prefer to remain anonymous)
• We will not take legal action against researchers who follow responsible disclosure

1. Use TLS everywhere: Frontend, backend, and database connections
2. Enable mTLS: For backend authentication and zero-trust architectures
3. Set strong JWT secrets: Use cryptographically secure random values
4. Bound remote signing-key trust: jwks_auth defaults jwks_max_stale_seconds to one hour and never permits an unlimited value. Set a shorter value when emergency issuer-key revocation must converge more quickly, while accounting for the availability impact of an IdP outage.
5. Configure rate limiting: Protect against abuse and DoS
6. Use IP restrictions: Limit admin API access to trusted sources
7. Keep dependencies updated: Monitor for security advisories
8. Enable audit logging: Track administrative changes
9. Run with minimal privileges: Don't run as root in containers
10. Protect the configuration database and its backups: Consumer API keys (keyauth) and shared secrets (jwt, hmac_auth) are stored recoverable at rest so the gateway can verify them; only Basic passwords are hashed. A database, replica, or backup read recovers them. See Credential storage at rest.

Ferrum Edge includes several security-focused features:

• mTLS support: Frontend and backend mutual TLS authentication
• JWT-based authentication: Secure admin API with configurable secrets
• Rate limiting: Token-bucket and Redis-backed distributed rate limiting
• IP restrictions: Whitelist/blacklist client IP addresses
• Request size limiting: Prevent large payload attacks
• Bot detection: Identify and block automated threats
• CORS handling: Configure cross-origin request policies
• Audit logging: Track all administrative changes

See the following documentation for detailed security configuration:

• Production hardening checklist — start here
• Threat model — trust boundaries, controls, and documented residuals
• Frontend TLS/mTLS
• Backend mTLS
• Database TLS
• Client IP Resolution

When security vulnerabilities are fixed, we will:

1. Release a patched version
2. Publish a security advisory on GitHub
3. Update this document with details (after coordinated disclosure)

Ferrum Edge gates its dependency tree and the vendored, patched upstream crates it carries in vendor/**. The authoritative, complete vendored-patch inventory — with owners, retirement triggers, the blocking advisory gate, time-boxed exception expiry, the vendor drift guard, and the emergency security-update process for vendored crates — is documented in docs/dependency-policy.md.

Key controls:

• Blocking advisory gate. cargo deny check advisories bans sources licenses runs on every PR (.github/workflows/ci.yml), once over the root workspace and once over the separate ebpf/Cargo.toml workspace with the same deny.toml. A RUSTSEC advisory not explicitly time-boxed in deny.toml fails the build.
• Weekly re-check. .github/workflows/dependency-audit.yml re-runs the gate against the latest advisory database, fails on expired exceptions, and reports when a vendored patch has merged upstream so it can be retired. This is why a fix in the reqwest/h3 lineage cannot be missed silently.
• Vendor integrity. tests/integration/vendor_integrity_tests.rs pins every vendored file to vendor/VENDOR_INTEGRITY.sha256; drift beyond the documented patches fails CI.

We thank the following security researchers who have responsibly disclosed vulnerabilities:

No vulnerabilities have been publicly disclosed at this time.

For questions about security practices or to report security concerns, contact: contact@ferrumedge.com