Report a vulnerability

How to report

Do not open a public issue for a security bug. Report it privately through GitHub private vulnerability reporting on Strazahq/straza, or by email to security@straza.ai.

Include what you can: the affected component (strazad, strazactl, the straza client or a wire format under spec/), the version or commit, the steps that reproduce it and your view of the impact. A proof of concept is welcome. Test only against systems you own.

The approver app has private vulnerability reporting enabled on its own repository, Strazahq/straza-mobile.

What happens next

• An acknowledgment within 72 hours.
• A triage verdict within 7 days: accepted, duplicate or not a vulnerability, with the reasoning.
• For an accepted report, a fix or a documented mitigation with a target of 90 days, ordered by severity.
• Coordinated disclosure: a publication date agreed with you, credit in the advisory unless you decline, and a GitHub Security Advisory that names the fixed versions.

The highest severity class is a kill-switch bypass, a policy-decision bypass, credential exposure to an agent, and snapshot or attestation forgery. A bypass of the MCP gateway is in scope. A bypass through interpreter indirection, or of a user-mode hook on a machine where the agent can run anything, is a documented limitation and not a vulnerability by itself.

Supported versions

The latest minor release of the current major receives security fixes. Older releases get fixes only for critical severities, on a best-effort basis. The full policy is SECURITY.md in the repository.

How Straza is built to fail

• Every decision fails closed. An unknown state is a deny that carries a reason the agent can read.
• Straza is a deterministic system of rule matching, token cryptography and hash chains. No shipped binary performs model inference.
• Policy snapshots are signed with Ed25519. A client refuses to enforce a snapshot it cannot verify against the keys it pinned at enrollment.
• Upstream tool credentials are sealed at rest on the Straza side and injected into the upstream request, so no credential for an MCP server behind the gateway sits on the agent's machine.
• A revoked identity is refused by the gateway on its next call, and by the workstation within seconds while the client daemon is connected.

The security model names the invariants and what each one costs, Known limits lists every risk they leave with you, and the security section of the docs covers credentials, keys, hardening and the supply chain.

The same contacts, in RFC 9116 format, are at /.well-known/security.txt.