Building a stronger security process for Meteor

Security is an area I have been thinking about for some time. A recent security-related PR brought the topic back to my attention, and I have also noticed more people in the community raising similar concerns.

I believe this is a good moment to discuss how we can improve security across Meteor and include concrete initiatives in our next roadmap. I would like to hear some ideas about what we can do, process, tools, and etc.

An initial audit

As a small baseline, I created a full application with Meteor 3.5.1 and ran npm audit.

The result was:

  • 8 moderate vulnerabilities
  • 0 high vulnerabilities
  • 0 critical vulnerabilities

Seven findings came from development tooling, mainly through the Rspack and webpack-dev-server dependency chain.

Running the audit without development dependencies left one moderate finding related to qs, included through url inside meteor-node-stubs. Wich already is solved in this PR

A few proposes

GitHub Security Advisory and CVEs

Meteor already has a security email address and a SECURITY.md. We could build on them with a clearer GitHub Security Advisory process:

  1. A user, researcher, or contributor privately reports a possible vulnerability.
  2. A maintainer validates the report and creates a private draft advisory.
  3. The reporter and necessary contributors can collaborate privately.
  4. The team identifies the affected versions, severity, mitigation, fix, and required backports.
  5. If no CVE exists, a maintainer can request one through GitHub.
  6. The corrected packages or Meteor versions are released.
  7. The advisory is published together with the security release and communication to users.

This would give maintainers a central place to coordinate fixes without disclosing vulnerabilities too early.

Automating Dependency Security Audits

There is already an open PR proposing automated npm security audits proposed by @harry97. This could help us detect vulnerable dependencies earlier, monitor Meteor’s npm packages continuously, and gradually introduce blocking checks for new high- or critical-severity findings without letting existing audit noise disrupt development.

Using Security Analysis Tools

We should also evaluate security analysis tools that can identify risks beyond npm dependencies. The StepSecurity PR opened @storyteller, for example, highlights possible improvements to GitHub Actions, token permissions, and third-party workflow dependencies. These tools could become part of periodic repository reviews, with maintainers validating each recommendation before adopting it.

But this PR bring me up a few questions: what tools should we use? what open source solutions do we have in the market?

Publishing an SBOM for Meteor Releases

Meteor could generate and publish a Software Bill of Materials for each release. An SBOM would provide a machine-readable inventory of the included packages and versions, helping maintainers and users quickly determine whether a release contains a vulnerable component. It would also improve supply-chain visibility and support organizations with security or compliance requirements.

Opening the discussion

npm audit cannot determine by itself whether every finding is exploitable in a Meteor application. It is only one input in a broader process of detection, triage, correction, and communication.

The goal of this proposal is not to suggest that Meteor is insecure. It is to make our security work more continuous, visible, and predictable.

These are only some initial ideas. We would like to hear from the community: what else can we improve in the framework, tooling, documentation, release process, or project governance. The idea is make Meteor and the applications built with it more secure?

2 Likes

Currently WeKan uses only GitHub Advisories, where I request CVE and publish advisory.

Vulnerabilities are also added to Hall of Fame:

https://wekan.fi/hall-of-fame/

Security and other maintenance processes are described at AGENTS.md and CLAUDE.md:

GitHub workflows builds releases for all platforms:

WeKan Security remediation and logging:

FerretDB Security remediation and logging:

Admin Panel / Problems:

This somewhat gets into the broader issue we have with our packaging system…

There is no easy way to publish a security update(embargoed or not) in core without doing a full-blown release or doing a form of fork.

I think we could brainstorm some scenarios and how it is expected of us to react to it, eh

A) We/Researcher/AI finds a core package vulnerability and reports to us; how fast could we publish a fix when we get one? How could we warn people that they should update their package? We should be able to give our users an easy path to update without having to fight a dependency graph or forking the package.

B) We/Researcher/AI find a non-core package vulnerability and reports to us; How could we fix this? Should we fix this? Should we fork and call it a day? What if our fix actually breaks the package? I think this is a very important conversation we should be having, especially now that AIs are VERY good at security stuff.

Thanks a lot for bringing this up @italojs

1 Like

Hmm, forking packages…

https://www.npmjs.com/search?q=%40wekanteam

For WeKan, if I’m awake:

  1. Fix may take from some minutes to some hours
  2. If I run all tests, one at a time, that can take over 1 hour. Running more tests at the same time can be flaky, some tests fail.
  3. When I change version number, GitHub Actions builds for all platforms, maybe within 1 hour for most platforms.
  4. Snap gets updates automatically. Others depend on whoever installed those, did they make any automatic update script. Some test Docker version first, update production later.
  5. If something does not work, someone complains at GitHub issues or email to support. Having all tests pass successfully does not quarantee that everything works, there can be corner cases etc.

This is why I started this:

We need to scan the NPM dependencies not just generally but also the ones within Atmosphere packages which needs a custom code. And this process needs to be integrated in our CI so no PR flies under the radar.