https: set the TLS minimum version explicitly #281

closed cmc opened this on 2026-09-28 04:33 UTC · ops security

Discussion

cmc 2026-09-28 04:33 UTC

The HTTPS listener sets no tls.Config.MinVersion or cipher policy (cmd/gitbayd/main.go); it relies on Go's defaults, which are sound in current Go but not stated anywhere an auditor can check.

  • Set MinVersion: tls.VersionTLS12 explicitly and document it on the Admin page.

referenced in commit 4e0958a163 by cmc: plans: open issues from the architecture and UX reviews

2026-09-28 05:43 UTC

closed by cmc in commit 928b919242: https: TLS 1.2 minimum, set explicitly

2026-09-28 21:49 UTC