Security Policy

At NexoralDNS, we take security seriously. As DNS infrastructure software, we understand the critical role security plays in protecting your network.

Supported Versions

We provide security updates for the following versions:

Recommendation: Always use the latest stable version to ensure you have the latest security patches.

cat VERSION

Reporting a Vulnerability

How to Report

1. Primary Method: Email

Send a detailed report to our security team:

• Email: security@nexoral.in
• Subject: [SECURITY] Brief description of the vulnerability
• Encryption: PGP key available at nexoral.in/security (optional but recommended)

2. For Premium Customers

• Use your priority support channel
• Mark the ticket as URGENT - SECURITY ISSUE
• We guarantee faster response times for premium customers

3. GitHub Security Advisories

• Use GitHub's Private Vulnerability Reporting
• This creates a private discussion with maintainers

What to Include in Your Report

1. Vulnerability Type
   • Type of vulnerability (e.g., XSS, SQL injection, authentication bypass)
   • CWE or CVE reference if applicable
2. Affected Components
   • Affected version(s)
   • Affected component (DNS server, web dashboard, API, etc.)
   • Free tier, premium tier, or both
3. Impact Assessment
   • Potential impact (data breach, DoS, privilege escalation, etc.)
   • Attack scenario and prerequisites
   • Your assessment of severity (Critical/High/Medium/Low)
4. Reproduction Steps
   • Detailed step-by-step instructions to reproduce
   • Proof of concept code (if applicable)
   • Screenshots or videos demonstrating the issue
5. Suggested Mitigation
   • Any workarounds or temporary fixes
   • Suggested patches (if you have them)

Response Timeline

Severity Response Targets

Security Best Practices for Users

For All Users

1. Keep Updated

curl -fsSL https://raw.githubusercontent.com/nexoral/NexoralDNS/main/Scripts/install.sh | bash -s update

2. Change Default Credentials

• Change default admin password immediately after installation
• Use strong, unique passwords

3. Network Security

• DO NOT expose to public internet (DNS port 53, Web port 4000)
• Use only within your LAN as intended
• Configure firewall rules appropriately

4. Access Control

• Limit access to the web dashboard
• Use premium tier for multi-user environments
• Regularly review user access

5. Monitor Logs

• Regularly check DNS query logs for suspicious activity
• Enable alerts for unusual patterns (premium feature)

6. Backup Configuration

• Regularly backup your configuration
• Test restore procedures
• Store backups securely

For Premium Users

7. Enable Advanced Security Features

• Configure access control policies
• Set up IP-based restrictions
• Use API keys with limited permissions

8. Audit Trail

• Review audit logs regularly
• Monitor user actions
• Set up automated alerting

Security Updates

Notification Channels

Security updates are announced through:

1. GitHub Security Advisories - Watch the repository
2. Release Notes - Always check before updating
3. Premium Email - Premium customers receive direct notifications
4. Website - nexoral.in/security

Applying Security Updates

# For Docker installations
curl -fsSL https://raw.githubusercontent.com/nexoral/NexoralDNS/main/Scripts/install.sh | bash -s update

# Verify update
cat VERSION

Always review release notes before updating to understand what's changed.

Scope

In Scope

The following are within the scope of our security program:

• ✅ NexoralDNS server application (DNS server, DHCP, Broker)
• ✅ Web dashboard and management interface
• ✅ API endpoints and authentication
• ✅ Access control mechanisms
• ✅ Data storage and encryption
• ✅ Docker containers and configurations
• ✅ Installation scripts

Out of Scope

The following are NOT in scope:

• ❌ Vulnerabilities in third-party dependencies (report to upstream)
• ❌ Social engineering attacks
• ❌ Physical security attacks
• ❌ Denial of Service (DoS) attacks
• ❌ Issues requiring physical access to the server
• ❌ Issues that only affect outdated/unsupported versions
• ❌ Issues in user-modified installations (license violation)
• ❌ Theoretical vulnerabilities without practical exploit

Safe Harbor

We support security research conducted in good faith. We will not pursue legal action against researchers who:

• Make a good faith effort to avoid privacy violations, data destruction, and service interruption
• Only interact with accounts they own or with explicit permission
• Do not exploit vulnerabilities beyond what's necessary to demonstrate the issue
• Follow this disclosure policy
• Do not violate any laws

Hall of Fame

We recognize and thank security researchers who have responsibly disclosed vulnerabilities:

Contact

• Security Email: security@nexoral.in
• General Contact: nexoral.in
• GitHub: github.com/nexoral/NexoralDNS

For non-security issues, please use our issue tracker or see the Contributing Guide.

Thank you for helping keep NexoralDNS and our users safe! 🔒