Security fixes target the latest released minor series. Upgrade older series to the latest release; older series do not receive backports.
Please do NOT report security vulnerabilities through public GitHub issues.
Instead, please report them via one of these methods:
- Email: lance@lance0.com
- GitHub: Use private vulnerability reporting
- Type of vulnerability (e.g., authentication bypass, injection, DoS)
- Full paths of source files related to the vulnerability
- Step-by-step instructions to reproduce
- Proof-of-concept or exploit code (if possible)
- Impact assessment
- Initial response: Within 48 hours
- Status update: Within 7 days
- Fix timeline: Depends on severity, typically 30-90 days
We consider security research conducted in accordance with this policy to be:
- Authorized and not subject to legal action
- Conducted in good faith
- Helpful to the security of the project
When deploying prefixd:
- Configure authentication - Use operator credentials, a strong bearer token
(for example,
openssl rand -hex 32), or native client-certificate mTLS. - Enable TLS - Never expose HTTP API without encryption
- Network isolation - Place prefixd on a management network
- Least privilege - Use operator roles appropriately (admin/operator/viewer)
- Safelist infrastructure - Add router loopbacks and critical IPs to safelist
- Review the audit trail - Use the dashboard Audit Log or
GET /v1/auditwith operator or administrator access. Production audit entries are stored in PostgreSQL, not a JSONL file. - Keep updated - Watch for security advisories
FlowSpec rules can drop traffic. The default guardrails restrict destinations to /32 IPv4 and /128 IPv6 hosts, require a TTL, check the safelist and limit rule counts and ports. Prefix bounds, TTL requirements and quotas are configurable; review the running configuration before enabling announcements.
Expiry requires a running controller and reconciliation. The separate BGP speaker can retain advertisements after prefixd stops; a TTL is not a speaker lease. See controller and speaker failures.
| Mode | Behavior |
|---|---|
none |
Bypasses authentication and role checks. Use only in an isolated development or test environment. |
credentials |
Operator passwords and PostgreSQL-backed sessions with viewer, operator and administrator roles. |
bearer |
A shared token grants operator-level API access. Password-authenticated sessions retain their own roles. |
mtls |
Requires native TLS and verified client certificates; accepted clients receive administrator access. Forwarded certificate headers do not authenticate a client. |
Use TLS for credentials, session cookies and bearer tokens. See the authentication reference and security model for deployment details.
/metrics is unauthenticated on the API listener. Default Compose leaves that
listener unpublished and blocks metrics through nginx and the dashboard proxy.
This does not authenticate scrapes: direct API access must stay on a trusted
management network.
Prometheus and Grafana publish only on host loopback by default, at ports 9091 and 3001. Remote access needs an operator-controlled tunnel or authenticated proxy. These bindings do not restrict other processes on the host.
We use cargo audit in CI to check for known vulnerabilities. Current advisories are documented in the CI workflow with justification for any ignores.