About · License · System Info · Privacy · Security · Changelog · README · Administrator Guide · User Guide

Transport Security

• TLS 1.3 enforced via Rustls (no OpenSSL dependency)
• RSA ciphers excluded; only elliptic-curve cryptography (ECC) used
• Automatic self-signed certificate generation (45-day validity)
• HTTP/1.1 + HTTP/2 auto-negotiated via ALPN over TCP
• HTTP/3 served over QUIC/UDP

Authentication

• Password hashing using Argon2id (RFC 9106)
• API key authentication for programmatic access
• Session-based authentication for the web UI

Data Integrity

• SHA-256 and SHA3-512 sidecar hash files for exported documents
• CSAF document validation on every create, update, import, and export
• Audit trail for all document lifecycle operations

Input Validation

• All CSAF documents validated against structural and semantic rules
• CVSS score range validation (0.0 to 10.0)
• Product ID cross-reference validation
• HTML output is escaped to prevent XSS
• RFC 9457 Problem Details for all API errors

Reporting Vulnerabilities

If you discover a security vulnerability in CSAF, please report it responsibly by contacting the development team at ndaal in Cologne.