Obsidian

Security Policy

Obsidian Sentinel WAF v2.2.4 Enterprise Edition

Obsidian Sentinel is a security-focused application designed to protect web applications. We take security vulnerabilities seriously and appreciate responsible disclosure from the security community.

Supported Versions

Versions currently being supported with security updates.

Version Supported Status End of Life
v2.x :white_check_mark: Current TBD
v1.x :x: Deprecated 2024-12-31

Enterprise Security Features

Obsidian Sentinel v2.2.4 includes comprehensive enterprise-grade security measures:

Authentication & Authorization

Network & Traffic Protection

Web Application Security

Data Protection & Privacy

Recent Security Fixes (v2.2.4)

XSS Vulnerability Mitigation

OAuth Security Enhancements

Authentication & Session Security

Infrastructure Security

Infrastructure Security

Reporting a Vulnerability

How to Report

⚠️ CRITICAL: Do NOT report security vulnerabilities through public GitHub issues.

Please report security vulnerabilities using one of these secure channels:

  1. GitHub Security Advisory (Preferred): Create Security Advisory
  2. Email: security@obsidianwaf.com (PGP Key: Available on request)
  3. Bug Bounty Program: Details available at security.obsidianwaf.com

Vulnerability Classification

Critical (CVSS 9.0-10.0)

High (CVSS 7.0-8.9)

Medium (CVSS 4.0-6.9)

Low (CVSS 0.1-3.9)

What to Include in Your Report

Required Information

Optional but Helpful

Response Timeline & Process

Phase Timeline Description
Acknowledgment 24 hours Initial response confirming receipt
Triage 72 hours Severity assessment and team assignment
Investigation 5-10 days Technical analysis and impact evaluation
Fix Development 15-30 days Patch development and testing
Release 30-45 days Security update release
Public Disclosure 90 days Coordinated disclosure (if applicable)

Critical vulnerabilities may have accelerated timelines with emergency patches released within 24-48 hours.

Security Best Practices for Deployment

Environment Hardening

# Generate cryptographically secure JWT secret
export OBSIDIAN_JWT_SECRET="$(openssl rand -base64 32)"

# Configure secure database connection
export DATABASE_URL="postgres://obsidian:$(openssl rand -base64 16)@localhost:5432/obsidian?sslmode=require"

# Set Redis with authentication
export REDIS_URL="redis://:$(openssl rand -base64 16)@localhost:6379/0"

# Restrict WebSocket origins to your domains
export OBSIDIAN_ALLOWED_ORIGINS="https://security.company.com,https://waf.company.com"

# Enable GeoIP with secure database location
export GEOIP_DATABASE_PATH="/secure/geoip/GeoLite2-Country.mmdb"

# Production logging level
export LOG_LEVEL="warn"

Network Configuration

# Deploy behind reverse proxy with rate limiting
upstream obsidian {
    server 127.0.0.1:8082;
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name waf.company.com;
    
    # Modern TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozTLS:10m;
    
    # Security headers
    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header Referrer-Policy strict-origin-when-cross-origin;
    
    location / {
        proxy_pass http://obsidian;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Kubernetes Security

apiVersion: v1
kind: SecurityContext
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 65534
    fsGroup: 65534
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: obsidian
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
    resources:
      limits:
        cpu: 500m
        memory: 512Mi
      requests:
        cpu: 100m
        memory: 128Mi

Database Security

-- Create dedicated database user with minimal privileges
CREATE USER obsidian_app WITH PASSWORD 'secure_random_password';
CREATE DATABASE obsidian_prod OWNER obsidian_app;
GRANT CONNECT ON DATABASE obsidian_prod TO obsidian_app;
GRANT USAGE ON SCHEMA public TO obsidian_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO obsidian_app;

-- Enable row-level security
ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE audit_logs ENABLE ROW LEVEL SECURITY;

Security Monitoring & Alerting

Key Metrics to Monitor

{
  "security_events_per_minute": "< 100 normal, > 500 investigate",
  "blocked_requests_percentage": "< 5% normal, > 20% investigate", 
  "failed_login_attempts": "< 10/hour normal, > 50/hour investigate",
  "jwt_token_failures": "< 1% normal, > 5% investigate",
  "rate_limit_triggers": "< 50/hour normal, > 200/hour investigate",
  "threat_intel_blocks": "monitor trends, sudden spikes indicate attacks",
  "geoip_blocks": "unusual countries may indicate compromise"
}

Webhook Alert Configuration

{
  "critical_alerts": {
    "webhook_url": "https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK",
    "events": ["authentication_bypass", "privilege_escalation", "rce_attempt"],
    "min_severity": "critical"
  },
  "security_team_alerts": {
    "webhook_url": "https://security.company.com/api/alerts",
    "events": ["high_volume_attacks", "new_threat_patterns"],
    "min_severity": "high"
  }
}

Known Security Considerations & Mitigations

Token Storage & Session Management

Consideration: JWT tokens stored in browser localStorage are accessible to XSS attacks.

Mitigations:

Development Mode Exposure

Consideration: Development mode (-dev flag) disables security features for testing.

Mitigations:

Rate Limiting Bypass

Consideration: Distributed attacks from many IPs may bypass per-IP rate limits.

Mitigations:

Database Security

Consideration: Direct database access could compromise audit integrity.

Mitigations:

Compliance & Certifications

Current Compliance Status

Future Certifications (Roadmap)

Security Audit History

Date Auditor Scope Findings Status
2026-01-15 Internal v2.1.0 Full Stack 3 Medium, 7 Low ✅ All Resolved
2025-11-20 Third-Party Authentication & Authorization 1 High, 2 Medium ✅ All Resolved
2025-09-10 Bug Bounty Public Interface 5 Low, 12 Info ✅ All Resolved

Security Training & Awareness

Developer Security Training

Operational Security

Contact Information

Security Team

PGP Keys

Security team PGP keys are available at: https://security.obsidianwaf.com/pgp-keys

Last Updated: February 1, 2026
Next Review: May 1, 2026
Document Version: 3.0 |——|———|———-|——–| | 2024-01-31 | Internal Review | JWT signature placeholder | Fixed in v2.0.0 | | 2024-01-31 | Internal Review | Mock data removal | Fixed in v2.0.0 | | 2024-01-31 | Internal Review | Race condition in persistence | Fixed in v2.0.0 |

🏆 Hall of Fame 🏆

Security researchers who have responsibly disclosed vulnerabilities:

  1. Your name could be here!

Thank you for helping keep Obsidian Sentinel and our users safe!

This site is open source. Improve this page.