Gatehouse is an edge proxy and treats downstream request data, upstream response data, configuration files, persisted snapshots, and SafeRPC frames as security boundaries.

Report suspected vulnerabilities privately through GitHub Security Advisories for the elixir-vibe/gatehouse repository. Do not include secrets, private keys, or production traffic captures in a public issue.

The mix ci quality gate runs mix hex.audit before compiling or starting the application. Security dependency updates should be applied independently of feature work and validated with the default and integration suites.

Gatehouse temporarily acknowledges CVE-2026-43966 and CVE-2026-43969 for Cowlib 2.19.0 because no fixed Hex release exists as of 2026-07-28. Cowlib 2.19.0 is required because it fixes the remotely reachable HPACK/QPACK memory-exhaustion issue CVE-2026-59248. The two remaining acknowledged APIs are outside Gatehouse's current use:

• Gatehouse does not configure Gun's cookie store and does not call cow_cookie:cookie/1. Consequently, downstream or upstream cookie values are never supplied to the vulnerable Cowlib cookie encoder.
• Gatehouse does not construct structured-field values with cow_http_struct_hd. Ordinary proxied request headers go through Gun 2.4's default invalid-request-header validation, which rejects CR and LF bytes.

Remove both ignore_advisories entries from mix.exs as soon as fixed releases or corrected advisory ranges are available. Reassess this exception before enabling a Gun cookie store, WebTransport structured headers, or direct Cowlib header encoding.

Incoming Forwarded and X-Forwarded-* values are untrusted client input by default. Gatehouse removes them and constructs a new forwarding identity from the request authority, listener scheme, and socket peer. A service may declare trusted proxy CIDRs with forwarding trusted_proxies: [...]; only an immediate peer in one of those ranges may extend an existing chain.

Gatehouse also removes standard hop-by-hop headers and every header named by the request's Connection field before contacting an upstream. If the ingress adapter does not provide peer metadata, Gatehouse fails closed: it discards the incoming chain and does not emit X-Forwarded-For. Livery adapter support for peer metadata is tracked in benoitc/livery#78.

Upstream response trailers are filtered before they reach the downstream connection. Gatehouse removes hop-by-hop fields plus Content-Length and Host, which are forbidden or unsafe as trailer fields. Downstream disconnects also cancel active HTTP or SafeRPC upstream work so abandoned clients do not consume backend capacity until a timeout expires.

HTTPS upstreams use peer and hostname verification by default. Gatehouse sends SNI for DNS targets, verifies IP-address targets against IP subject alternative names, and lets operators set an explicit server_name when the dial address and certificate identity differ. Every certificate in a custom CA file is PEM and ASN.1 decoded with OTP :public_key, then the file is fingerprinted while preparing a candidate runtime configuration; its policy is part of the connection-pool key and service fingerprint. verify: :verify_none disables both chain and identity verification and should only be used in isolated development environments.