# TrueNAS Security Advisories

> This site publishes security advisories and vulnerability information for TrueNAS products. Advisory data is organized by product type and accessible through both web interfaces and direct JSON files for programmatic access.

## Quick Reference - Site Navigation

### Product Security Pages
1. **TrueNAS CORE**: https://security.truenas.com/core/ - CORE product security advisories
2. **TrueNAS SCALE**: https://security.truenas.com/community-enterprise/ - SCALE product security advisories  
3. **TrueCommand**: https://security.truenas.com/truecommand/ - TrueCommand security information
4. **Solutions**: https://security.truenas.com/solutions/ - Enterprise solutions security

### Direct Advisory Data Access (JSON)
- **CORE Advisories**: https://security.truenas.com/advisories/CORE.json
- **SCALE Advisories**: https://security.truenas.com/advisories/SCALE.json
- **TrueCommand Advisories**: https://security.truenas.com/advisories/TrueCommand.json
- **Solutions Advisories**: https://security.truenas.com/advisories/Solutions.json

### CVE and Vulnerability Search
- **Search Pattern**: https://security.truenas.com/link/?reference={identifier}
- **Example**: https://security.truenas.com/link/?reference=CVE-2024-6387

## Site Structure and Data Access

### JavaScript Table Limitations
**Important**: The main product pages use JavaScript-rendered tables that load advisory data dynamically. LLMs cannot directly access the table content from the HTML pages.

**Solution**: Use the direct JSON file URLs listed above to access the actual advisory data programmatically.

### Advisory Data Structure
Each JSON file contains an array of advisory objects with these fields:
- **reference**: CVE number or internal identifier
- **component**: Affected software component
- **description**: Vulnerability description
- **severity**: Base severity rating
- **productVersionImpacted**: Affected TrueNAS versions
- **productVersionResolvedIn**: Version containing the fix
- **truenasSecurityRating**: TrueNAS-specific severity assessment

### Page Navigation Structure
- **Home Page**: https://security.truenas.com/ - Main landing page with product cards
- **Articles**: https://security.truenas.com/articles/ - Security analysis and special notices
- **CVE Database**: https://security.truenas.com/cves/ - Specific CVE analysis pages

## SBOM (Software Bill of Materials) Access

### SBOM File Locations
- **Direct Access**: https://security.truenas.com/sboms/ directory
- **File Pattern**: Version-based naming (e.g., `25.04.0.json`, `24.10.0.json`)
- **Content**: Complete software component listings for each TrueNAS release

### Product-Specific SBOM Pages
- **CORE SBOM**: https://security.truenas.com/core/core-sbom/
- **SCALE SBOM**: https://security.truenas.com/community-enterprise/sbom/
- **TrueCommand SBOM**: https://security.truenas.com/truecommand/truecommand-sbom/

## Vulnerability Reporting

**Contact Information**:
- **Email**: psirt@ixsystems.com
- **Jira Portal**: https://ixsystems.atlassian.net/servicedesk/customer/portal/21
- **PGP Keys**: Available at /secteam.pgp and /secengineer.pgp

## LLM Navigation Guidelines

### Accessing Advisory Data
1. **For specific CVE lookup**: Use the search pattern `/link/?reference={CVE-ID}`
2. **For product-specific advisories**: Access the appropriate JSON file directly
3. **For general security information**: Navigate to the relevant product page
4. **For compliance data**: Access SBOM files through direct links or product pages

### Data Processing Tips
- JSON files contain complete advisory data including severity ratings and fix versions
- Use the `truenasSecurityRating` field for TrueNAS-specific risk assessment
- Cross-reference `productVersionImpacted` and `productVersionResolvedIn` for version guidance
- Search functionality on web pages may not be accessible to LLMs - use JSON data instead

## Cross-References

### Main TrueNAS Documentation
- **Security Hardening**: https://truenas.com/docs/solutions/optimizations/security/ - Comprehensive security configuration guide
- **Software Status**: https://truenas.com/software-status/ - Update and security patch information
- **Main Documentation Hub**: https://truenas.com/docs/ - General TrueNAS documentation

### Related TrueNAS Sites
- **Apps Documentation**: https://apps.truenas.com/ - Application security considerations
- **API Documentation**: https://api.truenas.com/ - API security implementation
- **Community Forums**: https://truenas.com/community/ - Security discussions and support

## Usage Notes for LLMs

### Data Access Best Practices
- **Always use JSON files** for accessing actual advisory data rather than trying to parse JavaScript tables
- **CVE search functionality** works through the `/link/?reference=` pattern
- **SBOM files** are available both through product pages and direct `/sboms/` directory access
- **Product pages** provide context and navigation but advisory data is in JSON files

### Limitations
- **JavaScript tables on product pages** are not directly accessible to LLMs
- **TrueCommand page** is currently under construction
- **Search functionality** on web pages may not work for LLMs - use direct JSON access instead

### Contact Information
- **Security Team**: psirt@ixsystems.com
- **PGP Keys**: /secteam.pgp and /secengineer.pgp
- **Vulnerability Reporting**: https://ixsystems.atlassian.net/servicedesk/customer/portal/21