Please report vulnerabilities privately via GitHub private vulnerability reporting. Do not open a public issue for security problems.
You can expect a timely response. Please include enough detail to reproduce the issue (affected component, setup, steps).
There is no bug bounty program.
beanstore is in early development and has no releases yet. Only the main
branch is supported. Once versioned releases exist, this section will state
which release lines receive security fixes.
beanstore is a per-node storage daemon that manages LVM volumes and moves volume data between nodes. Of particular interest are issues in:
- the node-to-node move protocol (authentication, integrity of streamed extents, the commit/outcome-resolution rules),
- the gRPC control API (authentication bypass, state-machine violations that break the single-authoritative-copy invariant),
- privilege handling around LVM operations.