Feedback & Security Reporting
CheeseSec welcomes community contributions and operational feedback. Please use the appropriate channel below depending on the nature of your report:
General Feedback & Issue Tracking
1. GitHub Issues
For operational defects, bugs, runtime errors, documentation corrections, or feature proposals, open an issue in the corresponding GitHub repository:
| Project Scope | Repository & Issue Tracker | Intended Coverage |
|---|---|---|
| Core Engine & Server | LaokeQwQ/CheeseWAF Issues | WAF daemon, data plane proxy, AST semantic engine, CLI utilities, and Web console |
| Gateway Adapters | LaokeQwQ/CheeseWAF-Adapters Issues | NGINX auth_request, Envoy ext_authz, and the adapterd daemon |
| Plugin Ecosystem | LaokeQwQ/CheeseSec_Plugin Issues | CRP specification, package manifests, and registry admission policies |
| Technical Documentation | LaokeQwQ/CheeseSec_Docs Issues | Documentation accuracy, clarity, and bilingual synchronization |
Issue Submission Guidelines: Include your operating system, architecture, CheeseWAF version (cheesewaf version), deployment mode (systemd service or Docker), and minimal reproduction steps. Sanitize logs to ensure database credentials, API tokens, and private keys are never exposed in public issues.
2. Email Correspondence
For general questions, private deployment inquiries, or matters not suitable for a public tracker, contact the project team via email:
- Contact Email:
[email protected]
Critical Vulnerabilities & Security Disclosures
CheeseSec treats security defects with the highest priority. If you identify a security vulnerability, detection bypass, or critical stability defect in CheeseWAF or its ecosystem components, please follow Responsible Disclosure practices and do not post exploit details in public channels (such as GitHub Issues or social media).
Dedicated Security Contact
- Vulnerability Reporting Mailbox:
[email protected]
Scope of Security Reports
Reportable issues include, but are not limited to:
- Remote Code Execution (RCE) or arbitrary command injection
- Management plane authentication bypass, privilege escalation, or session forgery
- Universal detection bypasses against the AST semantic engine or baseline rulesets
- Uncontrolled resource consumption, memory leaks, or deadlocks causing high-severity Denial of Service (DoS)
- Exposure or insecure handling of sensitive configuration data, credentials, or keys
Recommended Report Contents
To accelerate verification and resolution, please include:
- Description & Severity: Vulnerability class, affected endpoints or components, and estimated impact.
- Affected Versions: Specific release versions or Git commit hashes.
- Proof of Concept (PoC): Clear, reproducible steps, including sample HTTP payloads, curl commands, or scripts.
- Prerequisites: Required user roles, configuration flags, or network topology necessary to trigger the defect.
- Remediation (Optional): Suggested patches or workarounds, if available.
Response & Handling Workflow
- Acknowledgment: The security team confirms receipt of reports sent to
[email protected]and opens an internal tracking case. - Triage & Reproduction: Engineers reproduce the PoC in an isolated environment, evaluate severity, and prioritize a patch.
- Patch & Advisory: Once a fix is implemented and verified, a security patch release and corresponding Security Advisory are published. We request that reporters maintain confidentiality until the patch is publicly available.