Report vulnerabilities privately. Do not open a public issue, pull request or discussion for them.

• Use GitHub private vulnerability reporting: report a vulnerability.
• If you cannot use it, email support@superlinked.com with "SIE security report" in the subject. Leave the details out of that first message: we reply with a private channel for them.

Include:

• the affected component: sie-server, the gateway, sie-config, sie-mcp, the Helm chart, an SDK or an integration;
• the version, image tag or commit;
• how to reproduce it, and the impact you observed.

We confirm receipt, keep you informed while we work on a fix, and credit you in the advisory unless you ask us not to.

Fixes land on main and ship in the next release. There are no maintenance branches. Advisories name the first fixed release.

What a default install exposes, and how to close it.

• By default the server binds every interface (0.0.0.0:8080) and accepts requests without authentication. Anyone who can reach the port can run inference, read /ws/status, and make the server load catalog models, which costs compute, disk and network.
• Keep it on this machine with --host 127.0.0.1. In Docker, publish the port on loopback only: -p 127.0.0.1:8080:8080.
• Do not expose an unauthenticated server to a network you do not control. Expose it through an authenticating proxy, or through the gateway with token authentication enabled.

• The gateway authenticates requests with static tokens: set SIE_AUTH_MODE=token and SIE_AUTH_TOKENS. Mutations of pools, admin and config routes also need SIE_ADMIN_TOKEN.
• /healthz, /readyz, /openapi.json and /docs are always reachable. /, /health and /ws/* require a token unless SIE_AUTH_EXEMPT_OPERATIONAL=true.
• Tokens are compared in constant time. An unknown SIE_AUTH_MODE, or tokens set while auth is off, makes the gateway refuse every non-probe request.

The chart README covers each of these in detail:

• The chart refuses to render an Ingress, LoadBalancer or NodePort gateway without authentication, unless you allow it explicitly.
• sie-config admin and read tokens are generated and kept across upgrades.
• NATS connections are authenticated per component by default.
• workers.networkPolicy.enabled=true admits only the gateway to the worker ports. Without it, any pod in the cluster can call a worker directly.
• Gateway token authentication (gateway.auth) and single sign-on (auth) are off by default. Turn one of them on before you expose the gateway.

sie-server sends anonymous usage telemetry. The README lists every field and how to turn it off.

Release 0.13.0 makes these defaults secure: a loopback bind for sie-server serve, a required token for any exposed server, generated tokens and a worker NetworkPolicy in the Helm chart, and telemetry off unless enabled. Earlier releases add the options and log warnings first. COMPATIBILITY.md has the details and the migration steps.