Vulnerability Management¶

Software has vulnerabilities. The goal isn't to have zero — it's to find and fix them quickly.

Dependency Scanning¶

Python Dependencies¶

Scan for known vulnerabilities in Python packages:

# Install safety
pip install safety

# Scan requirements
safety check -r requirements.txt

# Scan installed packages
safety check

Run this in CI on every PR and weekly on main.

Alternative: pip-audit¶

pip install pip-audit
pip-audit -r requirements.txt

Docker Image Scanning¶

Scan container images for OS-level vulnerabilities:

# Using Trivy (recommended)
trivy image mailyte-api:latest
trivy image mailyte-postfix:latest
trivy image mailyte-dovecot:latest
trivy image mailyte-rspamd:latest

# Scan all images
for img in api postfix dovecot rspamd cert_manager tracking webhooks analytics; do
  echo "=== mailyte-${img} ==="
  trivy image --severity HIGH,CRITICAL mailyte-${img}:latest
done

GitHub Dependabot¶

If the repo is on GitHub, enable Dependabot:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

  - package-ecosystem: "docker"
    directory: "/worker/api"
    schedule:
      interval: "weekly"

  - package-ecosystem: "docker"
    directory: "/mailer/postfix"
    schedule:
      interval: "weekly"

Container Image Updates¶

Base Image Policy¶

Update Process¶

# Pull latest base images
docker compose pull

# Rebuild all images with latest bases
docker compose build --no-cache

# Test
docker compose up -d
# Run health checks and tests

# Deploy
docker compose up -d

Automated Image Updates¶

Use a tool like Watchtower for automatic updates (use cautiously in production):

watchtower:
  image: containrrr/watchtower
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock
  environment:
    - WATCHTOWER_CLEANUP=true
    - WATCHTOWER_SCHEDULE=0 0 4 * * MON  # 4am every Monday
    - WATCHTOWER_NOTIFICATIONS=slack

Security Patches¶

Response Timeline¶

Patch Process¶

1. Assess — determine if the vulnerability affects Mailyte
2. Isolate — if actively exploited, apply a workaround immediately
3. Fix — update the dependency or apply a code fix
4. Test — verify the fix doesn't break anything
5. Deploy — push to production
6. Communicate — notify affected users if data was exposed

Common Vulnerability Areas¶

Email-Specific Risks¶

Application Risks¶

Security Monitoring Integration¶

Feed vulnerability scan results into your monitoring:

# Export Trivy results as Prometheus metrics
trivy image --format json mailyte-api:latest | \
  python3 scripts/trivy_to_prometheus.py > /var/lib/node-exporter/textfile/vulnerabilities.prom

Alert when new critical vulnerabilities are found:

- alert: CriticalVulnerability
  expr: mailyte_vulnerabilities{severity="CRITICAL"} > 0
  for: 1h
  labels:
    severity: critical
  annotations:
    summary: "Critical vulnerability found in {{ $labels.image }}"

Checklist¶

• Python dependency scanning in CI
• Docker image scanning in CI
• Dependabot or similar enabled
• Base images updated monthly
• Security patch response timeline defined
• CVE monitoring for Postfix, Dovecot, Rspamd
• SSRF protection on webhook URLs
• SQL injection prevention verified
• Regular penetration testing (annually)