%20scale(0.65)%20translate(-4%20-10)'%3e%3cpath%20d='M103%20140H50A37%2037%200%201%201%2066.44%2069.85A58%2058%200%200%201%20181.21%2067.44A38%2038%200%201%201%20197%20140H145V124A21%2021%200%200%200%20103%20124Z'%20fill='none'%20stroke='%231F2A33'%20stroke-width='18'%20stroke-linejoin='round'%20stroke-linecap='round'/%3e%3c/g%3e%3cpath%20d='M213.1%2092.04Q204.9%2092.04%20198.35%2088.29Q191.8%2084.54%20187.95%2078.04Q184.1%2071.54%20184.1%2063.44Q184.1%2055.34%20187.9%2048.89Q191.7%2042.44%20198.3%2038.74Q204.9%2035.04%20213.1%2035.04Q219.2%2035.04%20224.4%2037.14Q229.6%2039.24%20233.3%2042.99Q237%2046.74%20238.6%2051.84L225.6%2057.44Q224.2%2053.34%20220.85%2050.94Q217.5%2048.54%20213.1%2048.54Q209.2%2048.54%20206.15%2050.44Q203.1%2052.34%20201.35%2055.74Q199.6%2059.14%20199.6%2063.54Q199.6%2067.94%20201.35%2071.34Q203.1%2074.74%20206.15%2076.64Q209.2%2078.54%20213.1%2078.54Q217.6%2078.54%20220.9%2076.14Q224.2%2073.74%20225.6%2069.64L238.6%2075.34Q237.1%2080.14%20233.4%2083.94Q229.7%2087.74%20224.5%2089.89Q219.3%2092.04%20213.1%2092.04ZM263.3%2092.04Q257.4%2092.04%20253.1%2090.14Q248.8%2088.24%20246.5%2084.69Q244.2%2081.14%20244.2%2076.24Q244.2%2071.64%20246.3%2068.09Q248.4%2064.54%20252.75%2062.14Q257.1%2059.74%20263.6%2058.74L280.3%2056.04V67.04L266.3%2069.54Q263.1%2070.14%20261.4%2071.59Q259.7%2073.04%20259.7%2075.74Q259.7%2078.24%20261.6%2079.64Q263.5%2081.04%20266.3%2081.04Q270%2081.04%20272.8%2079.44Q275.6%2077.84%20277.15%2075.09Q278.7%2072.34%20278.7%2069.04V54.84Q278.7%2051.74%20276.25%2049.64Q273.8%2047.54%20269.6%2047.54Q265.6%2047.54%20262.55%2049.74Q259.5%2051.94%20258.1%2055.54L246.1%2049.84Q247.7%2045.24%20251.2%2041.94Q254.7%2038.64%20259.6%2036.84Q264.5%2035.04%20270.3%2035.04Q277.2%2035.04%20282.5%2037.54Q287.8%2040.04%20290.75%2044.49Q293.7%2048.94%20293.7%2054.84V90.84H279.7V82.04L283.1%2081.44Q280.7%2085.04%20277.8%2087.39Q274.9%2089.74%20271.3%2090.89Q267.7%2092.04%20263.3%2092.04ZM303.7%2090.84V15.14H318.7V47.04L316.9%2044.64Q318.8%2039.74%20323.05%2037.39Q327.3%2035.04%20333%2035.04Q339.2%2035.04%20343.85%2037.64Q348.5%2040.24%20351.1%2044.89Q353.7%2049.54%20353.7%2055.74V90.84H338.7V58.94Q338.7%2055.74%20337.45%2053.44Q336.2%2051.14%20333.95%2049.84Q331.7%2048.54%20328.7%2048.54Q325.8%2048.54%20323.5%2049.84Q321.2%2051.14%20319.95%2053.44Q318.7%2055.74%20318.7%2058.94V90.84ZM382.2%2092.04Q375.6%2092.04%20370.95%2089.19Q366.3%2086.34%20363.9%2081.24Q361.5%2076.14%20361.5%2069.34V36.24H376.5V68.14Q376.5%2071.24%20377.75%2073.59Q379%2075.94%20381.3%2077.24Q383.6%2078.54%20386.5%2078.54Q389.5%2078.54%20391.75%2077.24Q394%2075.94%20395.25%2073.59Q396.5%2071.24%20396.5%2068.14V36.24H411.5V90.84H397.5V80.04L398.3%2082.44Q396.4%2087.34%20392.15%2089.69Q387.9%2092.04%20382.2%2092.04ZM447.8%2091.44Q437.9%2091.44%20432.45%2086.09Q427%2080.74%20427%2071.14V49.24H417.8V36.24H418.3Q422.5%2036.24%20424.75%2034.14Q427%2032.04%20427%2027.84V23.84H442V36.24H454.8V49.24H442V70.14Q442%2072.94%20443%2074.79Q444%2076.64%20446.1%2077.54Q448.2%2078.44%20451.3%2078.44Q452%2078.44%20452.9%2078.34Q453.8%2078.24%20454.8%2078.14V90.84Q453.3%2091.04%20451.4%2091.24Q449.5%2091.44%20447.8%2091.44Z'%20fill='%231F2A33'/%3e%3c/svg%3e){kind=small}
%20scale(0.65)%20translate(-4%20-10)'%3e%3cpath%20d='M103%20140H50A37%2037%200%201%201%2066.44%2069.85A58%2058%200%200%201%20181.21%2067.44A38%2038%200%201%201%20197%20140H145V124A21%2021%200%200%200%20103%20124Z'%20fill='none'%20stroke='%23F7F5F0'%20stroke-width='18'%20stroke-linejoin='round'%20stroke-linecap='round'/%3e%3c/g%3e%3cpath%20d='M213.1%2092.04Q204.9%2092.04%20198.35%2088.29Q191.8%2084.54%20187.95%2078.04Q184.1%2071.54%20184.1%2063.44Q184.1%2055.34%20187.9%2048.89Q191.7%2042.44%20198.3%2038.74Q204.9%2035.04%20213.1%2035.04Q219.2%2035.04%20224.4%2037.14Q229.6%2039.24%20233.3%2042.99Q237%2046.74%20238.6%2051.84L225.6%2057.44Q224.2%2053.34%20220.85%2050.94Q217.5%2048.54%20213.1%2048.54Q209.2%2048.54%20206.15%2050.44Q203.1%2052.34%20201.35%2055.74Q199.6%2059.14%20199.6%2063.54Q199.6%2067.94%20201.35%2071.34Q203.1%2074.74%20206.15%2076.64Q209.2%2078.54%20213.1%2078.54Q217.6%2078.54%20220.9%2076.14Q224.2%2073.74%20225.6%2069.64L238.6%2075.34Q237.1%2080.14%20233.4%2083.94Q229.7%2087.74%20224.5%2089.89Q219.3%2092.04%20213.1%2092.04ZM263.3%2092.04Q257.4%2092.04%20253.1%2090.14Q248.8%2088.24%20246.5%2084.69Q244.2%2081.14%20244.2%2076.24Q244.2%2071.64%20246.3%2068.09Q248.4%2064.54%20252.75%2062.14Q257.1%2059.74%20263.6%2058.74L280.3%2056.04V67.04L266.3%2069.54Q263.1%2070.14%20261.4%2071.59Q259.7%2073.04%20259.7%2075.74Q259.7%2078.24%20261.6%2079.64Q263.5%2081.04%20266.3%2081.04Q270%2081.04%20272.8%2079.44Q275.6%2077.84%20277.15%2075.09Q278.7%2072.34%20278.7%2069.04V54.84Q278.7%2051.74%20276.25%2049.64Q273.8%2047.54%20269.6%2047.54Q265.6%2047.54%20262.55%2049.74Q259.5%2051.94%20258.1%2055.54L246.1%2049.84Q247.7%2045.24%20251.2%2041.94Q254.7%2038.64%20259.6%2036.84Q264.5%2035.04%20270.3%2035.04Q277.2%2035.04%20282.5%2037.54Q287.8%2040.04%20290.75%2044.49Q293.7%2048.94%20293.7%2054.84V90.84H279.7V82.04L283.1%2081.44Q280.7%2085.04%20277.8%2087.39Q274.9%2089.74%20271.3%2090.89Q267.7%2092.04%20263.3%2092.04ZM303.7%2090.84V15.14H318.7V47.04L316.9%2044.64Q318.8%2039.74%20323.05%2037.39Q327.3%2035.04%20333%2035.04Q339.2%2035.04%20343.85%2037.64Q348.5%2040.24%20351.1%2044.89Q353.7%2049.54%20353.7%2055.74V90.84H338.7V58.94Q338.7%2055.74%20337.45%2053.44Q336.2%2051.14%20333.95%2049.84Q331.7%2048.54%20328.7%2048.54Q325.8%2048.54%20323.5%2049.84Q321.2%2051.14%20319.95%2053.44Q318.7%2055.74%20318.7%2058.94V90.84ZM382.2%2092.04Q375.6%2092.04%20370.95%2089.19Q366.3%2086.34%20363.9%2081.24Q361.5%2076.14%20361.5%2069.34V36.24H376.5V68.14Q376.5%2071.24%20377.75%2073.59Q379%2075.94%20381.3%2077.24Q383.6%2078.54%20386.5%2078.54Q389.5%2078.54%20391.75%2077.24Q394%2075.94%20395.25%2073.59Q396.5%2071.24%20396.5%2068.14V36.24H411.5V90.84H397.5V80.04L398.3%2082.44Q396.4%2087.34%20392.15%2089.69Q387.9%2092.04%20382.2%2092.04ZM447.8%2091.44Q437.9%2091.44%20432.45%2086.09Q427%2080.74%20427%2071.14V49.24H417.8V36.24H418.3Q422.5%2036.24%20424.75%2034.14Q427%2032.04%20427%2027.84V23.84H442V36.24H454.8V49.24H442V70.14Q442%2072.94%20443%2074.79Q444%2076.64%20446.1%2077.54Q448.2%2078.44%20451.3%2078.44Q452%2078.44%20452.9%2078.34Q453.8%2078.24%20454.8%2078.14V90.84Q453.3%2091.04%20451.4%2091.24Q449.5%2091.44%20447.8%2091.44Z'%20fill='%23F7F5F0'/%3e%3c/svg%3e){kind=small}
Politique de sécurité
Cahut est un serveur qui reçoit du HTML d’une IA et le sert à des lecteurs. Sa sécurité compte plus que n’importe quelle fonctionnalité. Merci de signaler ce que vous trouvez.
Signaler une faille
Signalez en privé, jamais dans un ticket ou une discussion publics :
- par le signalement privé de GitHub : signaler une faille ;
- ou par e-mail à
security@cahut.cloud.
Dites ce que vous avez trouvé, comment le reproduire, et ce que cela permet selon vous. En anglais ou en français.
À quoi s’attendre
- Un accusé de réception sous sept jours.
- Une correction et une publication coordonnée sous quatre-vingt-dix jours, bien plus tôt pour une faille grave. Vous connaissez la date avant que nous publiions.
- Un avis de sécurité GitHub avec un CVE, et une release de correctif qui le cite.
- Votre nom dans l’avis et dans les notes de release, sauf si vous préférez ne pas être nommé.
Il n’y a pas de programme de primes.
Périmètre
Dans le périmètre : le binaire cahut et ses commandes, le point d’accès MCP, la console et son API, install.sh, la chaîne de release, et les sites cahut.cloud et docs.cahut.cloud. Tout moyen pour une Window de lire une autre Window, la console ou la session du lecteur est une faille : le bac à sable est la protection principale (ADR 10).
Hors périmètre : le contenu que les gens publient dans leurs Windows, les clients d’IA, et les services tiers.
Versions prises en charge
Seule la dernière release reçoit des corrections. Cahut est en 0.x : mettez à jour dès qu’une release sort. Un serveur se met à jour chaque jour vers les versions correctives de sa version mineure, et sudo /usr/local/bin/cahut update installe toute release plus récente.
Les rapports écrits par une IA
Reproduisez avant de signaler. Un rapport généré par une IA que personne n’a vérifié est fermé sans réponse. Un rapport inventé vaut un bannissement à son auteur.