Software security

The software has not been through an external security audit (penetration test by a firm). Instead, each version goes through:

• static analysis of the code (compiler warnings treated as errors);
• a dependency audit: known vulnerabilities, licences and origin of each library;
• a secret scan of the whole code history;
• isolation tests between customers: a customer, a reseller or an API key reads or changes nothing outside its scope;
• tests on a real FreeSWITCH: calls, call flows, forwarding, encryption, on every change;
• a written security review, redone at each major version.

If your business requires it, you can have a penetration test carried out at your own cost: let the vendor know, who will give you the scope and respond to the findings.

What protects your instance

• Accounts: long passwords, lockout after 5 failures, second factor required for the operator’s and resellers’ teams, passkeys.
• API: revocable keys, rights limited to their organisation.
• SIP: banning of addresses that fail to authenticate too often (Diagnostics), SIP over TLS and SRTP offered.
• Secrets (trunks, email server, keys) encrypted in the database; none is returned by the API.
• Audit log of every change, readable in the portal.

Report a vulnerability

Write to the vendor, at the security address in your contract, with “Security” in the subject. Give the version (version in /api/v1/sante), what reproduces the problem and its effect. Answer within 3 working days. The fix is published in the apt repository and you are told directly, with the version that fixes it: apply it like an update.