AspNetCore.Ignite versions track the Apache Ignite version they are built against (e.g. 2.18.0 uses Apache Ignite 2.18.0). Only the latest release receives security fixes. This applies to all artifacts produced by this repository:

If you find a security issue in an older version, please first check whether it still reproduces on the latest version. If you can't upgrade, let us know why so we can better understand your situation.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Report them privately through GitHub Security Advisories ("Report a vulnerability" under the repository's Security tab).

Please include as much of the following as you can:

• Affected artifact (NuGet package, server, Docker image) and version
• Configuration involved (e.g. appsettings.json values, Spring XML config, persistence/SSL/authentication settings, Kubernetes discovery)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code, if available
• Impact of the issue and how an attacker might exploit it

You should receive an acknowledgement within a few days. We will keep you informed of the progress toward a fix and may ask for additional information. Please give us a reasonable amount of time to release a fix before any public disclosure.

In scope:

• Code in this repository: the AspNetCore.Ignite library, the AspNetCore.IgniteServer host, the Dockerfile, the bundled Spring XML configuration files and the GitHub Actions workflows.

Out of scope — please report these upstream instead:

• Vulnerabilities in Apache Ignite itself (Java core, .NET bindings, thin client) → the Apache Software Foundation security team.
• Vulnerabilities in third-party dependencies (Serilog, Polly, Jetty, Jackson, etc.) → the respective project. We do want to hear about vulnerable dependency versions shipped by this project, so we can upgrade them.
• The Helm chart → dradoaica/helm-charts.

The defaults in this repository are meant for local development only. Before running AspNetCore.IgniteServer in any shared or production environment:

• Replace the bundled certificates. The key stores and certificates in src/AspNetCore.IgniteServer/config (server.jks, trust.jks, thin-client-cert.pfx) are public sample files generated by cmd/ssl.ps1. Generate your own and never commit private keys.
• Change all default passwords. appsettings.json ships with well-known values for IGNITE_USER_PASSWORD and the SSL_*_PASSWORD settings. Override them via environment variables or Kubernetes secrets.
• Keep authentication and SSL enabled (ENABLE_AUTHENTICATION, USE_SSL, USE_CLIENT_SSL).
• Restrict network exposure. The image exposes Ignite discovery/communication ports (47500, 47100), the thin client port (10800), the REST/HTTP ports (8080, 11211) and other management ports. Only publish what your clients need and keep cluster-internal ports on a private network.
• Keep up to date with the latest release of this project, which picks up Apache Ignite and .NET security fixes.