Security

Report a vulnerabilityCopy Anchor Link

Do not open a public issue or pull request for a security problem.

Email security@synap.live with:

• what is affected: the pod (backend), the CLI, Synap Cloud, an app, or this site, and the version if you know it;
• how to reproduce it, and what an attacker could do with it;
• whether you want to be credited, and how.

This applies to the open-source repositories and to Synap Cloud.

What happens nextCopy Anchor Link

We acknowledge your report, investigate, and keep you informed until it is fixed. We ask you not to disclose the problem publicly until a fix is released and pod operators have had a reasonable time to update.

For pod operatorsCopy Anchor Link

• Keep your pod updated: Upgrades. Automatic updates apply signed releases only.
• Verify releases with cosign and SYNAP_RELEASE_VERIFY=enforce: Verifying releases.
• Keep the database, MinIO, Typesense and Kratos ports on 127.0.0.1, as the stock configuration does: only Caddy should face the internet.
• Give agents and integrations their own keys with the smallest grant that works: API keys.