netwatch-rs 0.2.0

A modern network traffic monitor for Unix systems, inspired by nload but written in Rust
Documentation
# Security Policy

## Supported Versions

We provide security updates for the following versions of netwatch:

| Version | Supported          |
| ------- | ------------------ |
| 0.1.x   | :white_check_mark: |

## Reporting a Vulnerability

We take security seriously. If you discover a security vulnerability in netwatch, please report it responsibly.

### How to Report

**DO NOT** open a public GitHub issue for security vulnerabilities.

Instead, please send an email to the maintainers with:

- A description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Suggested fixes (if any)

### Response Timeline

- **Initial Response**: Within 48 hours
- **Assessment**: Within 1 week
- **Fix Development**: Depends on severity
- **Public Disclosure**: After fix is released

### Vulnerability Assessment

We classify vulnerabilities using the following criteria:

#### Critical
- Remote code execution
- Privilege escalation
- Data exfiltration

#### High
- Denial of service attacks
- Information disclosure
- Local privilege escalation

#### Medium
- Limited information disclosure
- Resource exhaustion

#### Low
- Minor information leaks
- Configuration issues

## Security Measures

### Development Security

- **Memory Safety**: Rust's ownership system prevents common vulnerabilities like buffer overflows and use-after-free
- **Dependency Scanning**: Automated security auditing with `cargo audit` and `cargo deny`
- **Static Analysis**: Comprehensive linting with Clippy
- **Code Review**: All changes require review before merging

### Runtime Security

- **Privilege Separation**: Runs with minimal required privileges
- **Input Validation**: All user inputs are validated and sanitized
- **Error Handling**: Secure error handling that doesn't leak sensitive information
- **Resource Limits**: Built-in protections against resource exhaustion

### Network Security

- **Read-Only Operations**: Only reads network interface statistics
- **No Network Transmission**: Does not send data over the network
- **Local Access Only**: Only accesses local system resources
- **Interface Validation**: Validates network interface names before access

## Security Best Practices

### For Users

1. **Keep Updated**: Always use the latest version
2. **Minimal Privileges**: Run with least required privileges
3. **Secure Environment**: Use in trusted environments
4. **Monitor Logs**: Watch for unusual behavior

### For Developers

1. **Secure Coding**: Follow Rust security best practices
2. **Dependency Updates**: Keep dependencies current
3. **Testing**: Include security-focused tests
4. **Documentation**: Document security considerations

## Known Security Considerations

### System Access

netwatch requires read access to:
- `/proc/net/dev` (Linux) - Network interface statistics
- `/sys/class/net/` (Linux) - Network interface information
- System calls for network statistics (macOS)

### Permissions

- **Linux**: No special privileges required for basic functionality
- **macOS**: May require elevated privileges for detailed network information
- **No Root Required**: Designed to work without root access when possible

### Data Handling

- **No Persistence**: Does not store sensitive data permanently
- **Memory Security**: Uses Rust's memory safety guarantees
- **Log Security**: Logs contain only network statistics, no sensitive data

## Security Updates

Security fixes are prioritized and released as patch versions. Users should:

1. Subscribe to release notifications
2. Update promptly when security fixes are available
3. Review changelog for security-related changes

## Compliance

netwatch is designed to comply with:

- Standard Unix security practices
- Principle of least privilege
- Defense in depth
- Secure by default configuration

## Third-Party Dependencies

We regularly audit dependencies for:

- Known vulnerabilities (CVE database)
- Maintenance status
- License compatibility
- Security best practices

Current security scanning includes:
- RustSec Advisory Database
- GitHub Security Advisories
- Automated dependency updates via Dependabot

## Contact

For security-related questions or concerns:
- Open a public issue for general security questions
- Email maintainers for vulnerability reports
- Review this document for security guidelines

---

Last updated: 2024
Security policy version: 1.0