Reporting a problem, and what we can and cannot see.
Portiger runs inside other people's infrastructure, which shapes what we are able to do about a vulnerability and what we are able to see when something goes wrong.
Reporting a vulnerability
Send it to security@portiger.com. A working proof of concept, the version you tested and the conditions it needs are worth more than a scanner report, and they are what let us reproduce the problem instead of guessing at it.
We will not take legal action over research done in good faith against your own installation. Please do not test against someone else's, and please give us a chance to ship a fix before publishing.
There is no published response-time target. What happens instead: we confirm the report has been read, say whether we treat it as a vulnerability, and keep you posted while it is being fixed.
What is in scope
- The control plane and its agent
- The licence server and the account area at
portiger.com/account - This site
Out of scope: findings that need an attacker to already be root on the host, missing headers on a static marketing page with no session to steal, and reports whose only evidence is a scanner's output.
What we do not have
Portiger gives us no way into your systems. There is no support tunnel, no remote shell, no phone-home channel that carries commands and no credential of ours installed anywhere on your machines. If we need to see something to help you, you have to send it to us.
This cuts both ways and it is worth being honest about it: it also means we cannot fix an installation for you, and we cannot recover data you have lost.
What talks to us
A licensed installation contacts the licence server on a schedule to confirm its licence and collect a fresh one. That connection carries the licence, a proof that the installation holds the matching private key, and nothing about what you are running. The privacy notice lists the fields.
In the control plane's case your servers do not make that call at all. The control plane makes it and hands each agent a signed lease, and the agents only ever connect outward to the control plane you installed.
Signing
Licences are signed with Ed25519 and verified locally, so an installation can tell a real licence from a forged one without asking anyone. Each installation holds a private key it generated itself and never transmits; proving possession of that key is what stops a copied licence from working on a second machine.