Security

Reporting a vulnerability

Send a description to security@assuremesh.com. Encrypt with the public key below if the report is sensitive.

What AssureMesh commits to

• Acknowledgement within 3 business days of receipt.
• Initial triage decision within 10 business days.
• No legal action against good-faith researchers who avoid privacy violations and service disruption, report privately, and give AssureMesh reasonable time to remediate before public disclosure.
• Optional public acknowledgement of your contribution if you wish.

Out of scope

• Social engineering of AssureMesh personnel or customers.
• Physical attacks on AssureMesh property.
• Denial-of-service testing.
• Findings limited to missing best-practice headers without demonstrated exploitation.

There is currently no paid bounty programme. Acknowledgement is on request.

Release provenance

AssureMesh signs the SHA-256 checksums file of every release using Sigstore keyless signing via GitHub OIDC. There is no long-lived AssureMesh signing key. Every signature is cryptographically bound to a specific GitHub Actions workflow run on a specific git tag, and recorded in the Rekor public transparency log.

Keyless signing and the public transparency log make release identity and checksums independently verifiable. This control supports software-supply-chain provenance, but does not by itself constitute a SLSA level or an external certification.

Verifying a release

# Install Cosign once (macOS):
brew install cosign
# Or on Linux:
curl -L https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
  -o /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign

# Download the release artifact, the checksums file, and the cosign
# signature + certificate from the GitHub release page:
curl -LO https://github.com/assuremesh/assuremesh/releases/download/v0.1.0/assuremesh-v0.1.0-linux-amd64.tar.gz
curl -LO https://github.com/assuremesh/assuremesh/releases/download/v0.1.0/assuremesh-v0.1.0-checksums.txt
curl -LO https://github.com/assuremesh/assuremesh/releases/download/v0.1.0/assuremesh-v0.1.0-checksums.txt.sig
curl -LO https://github.com/assuremesh/assuremesh/releases/download/v0.1.0/assuremesh-v0.1.0-checksums.txt.pem

# Verify the signature was issued to the expected workflow at the
# expected tag. Mismatch on either field means do not trust the artifact.
cosign verify-blob \
  --certificate "assuremesh-v0.1.0-checksums.txt.pem" \
  --signature   "assuremesh-v0.1.0-checksums.txt.sig" \
  --certificate-identity     "https://github.com/assuremesh/assuremesh/.github/workflows/release.yml@refs/tags/v0.1.0" \
  --certificate-oidc-issuer  "https://token.actions.githubusercontent.com" \
  "assuremesh-v0.1.0-checksums.txt"

# Then verify the SHA-256 sums against the file you downloaded:
sha256sum -c assuremesh-v0.1.0-checksums.txt

What "no signing key" means for you

Nothing to rotate. Nothing to compromise. Nothing to store. The cryptographic anchor is the public Sigstore root of trust (operated by the Linux Foundation) plus the public Rekor transparency log — both independently verifiable.

If you previously verified an AssureMesh release with GPG, that workflow has been retired. The verification recipe above is the only supported one going forward.

Sub-processors

AssureMesh production infrastructure is hosted on Google Cloud Platform (GCP) in us-central1. Hostinger is used for email delivery, and Google Analytics processes public-site usage data. Customer passwords are bcrypt-hashed; session tokens are cryptographically signed. Optional or customer-specific processors are disclosed during contracting before they receive customer data.

Network access posture

AssureMesh is read-only by default. Monitoring-only device credentials are preferred, and configuration write actions are blocked in the platform. Recommendations are labelled as not executed.

Security file

The machine-readable security disclosure file is published at /.well-known/security.txt per RFC 9116.