'/%3e%3cpath%20id='cross_2'%20data-name='cross%202'%20class='cls-2'%20d='M20.612,30.43h0a5.361,5.361,0,1,0-10.723,0H0A33.709,33.709,0,0,1,30.569,0V9.75a5.361,5.361,0,1,1,0,10.723V30.43Z'%20transform='translate(67.193%200.007)%20rotate(90)'/%3e%3cpath%20id='cross_3'%20data-name='cross%203'%20class='cls-3'%20d='M20.612,30.43h0a5.361,5.361,0,1,0-10.723,0H0A33.709,33.709,0,0,1,30.569,0V9.75a5.361,5.361,0,1,1,0,10.723V30.43Z'%20transform='translate(67.186%2067.041)%20rotate(180)'/%3e%3cpath%20id='cross_4'%20data-name='cross%204'%20class='cls-4'%20d='M20.6,30.5h0a5.361,5.361,0,1,0-10.723,0H0A33.71,33.71,0,0,1,30.56,0V9.818a5.361,5.361,0,1,1,0,10.723V30.5Z'%20transform='translate(0%2067.041)%20rotate(-90)'/%3e%3c/svg%3e)
How SetFN Reviews Security and Ships Updates
SetFN SpaceBuilder is a server product that customers install themselves to manage internal documents and run websites (CMS). Because the files and accounts of many users gather on a single server, SetFN reviews security before shipping an update and records the results, with dates, in this section.
This document explains the kinds of review SetFN performs, the security standards it refers to, and how to check the review records.
Pre-release review
The following checks are performed before an update is released.
| Check | Description |
|---|---|
| Automated tests | Runs server feature tests and browser-based UI tests that cover sign-in, upload, sharing, and permission scenarios. |
| Verification on an isolated test server | Starts a separate test server with its own accounts, isolated from production data, and verifies permission, sharing, and authentication boundaries as well as overload conditions with real requests. |
| Dependency vulnerability scan | Go libraries used by the server are checked against the official Go vulnerability database, and web UI libraries against npm security advisories. Vulnerabilities in code that is actually called are upgraded to the fixed version. |
| AI-assisted code review | Changed code and existing code are reviewed with Anthropic Claude and OpenAI Codex. Issues found by AI are fixed only after they are confirmed in the code and by running it. Fixes made by one AI are cross-reviewed read-only by another AI (Codex) before release. |
| Cross-check against external security advisories | KISA (KrCERT/CC) security notices and the security advisories of each component are checked to determine whether they apply to SetFN. |
Regular review and document updates
Separately from the pre-release review, the entire codebase is reviewed again regularly with AI (Claude, Codex). When a new attack type or security notice is published, SetFN checks whether it applies.
The following documents are updated after every review.
- Security Review Log: Records the date, scope, issues found, and remediation status of each review, newest first.
- Vulnerability Status: Summarizes in tables whether major vulnerabilities (CVEs) and KISA security notices published since 2025 apply to SetFN, and whether review and remediation are complete.
Latest security review on the Docs home page shows the date and summary of the most recent review.
Security standards we refer to
Review items are chosen with reference to the following standards.
| Standard | Publisher | What we refer to |
|---|---|---|
| OWASP Top 10:2025 | OWASP | The ten major web application risks (access control, misconfiguration, supply chain, exceptional condition handling, and more) |
| OWASP ASVS 5.0 | OWASP | Verification requirements for authentication, sessions, authorization, file handling, configuration, logging, and error handling |
| CWE Top 25 (2025) | MITRE and CISA | Weakness types that appear frequently in real vulnerabilities (including unrestricted resource allocation) |
| NIST SP 800-63B-4 | National Institute of Standards and Technology (USA) | Guidelines for managing passwords and authenticators |
| Detailed Guide to Technical Vulnerability Analysis and Assessment of Critical Information Infrastructure | Korea Internet & Security Agency (KISA) | Web vulnerability checklist items |
Reporting a security issue
If you find behavior in SetFN that looks like a security issue, let us know through Contact. Including the steps to reproduce it and the SetFN version you are using helps us confirm it faster. Please do not post the reproduction steps publicly until the review is complete.
Good to Know
- A security review reduces known risks; it does not guarantee that no risk remains.
- The operating system, reverse proxy (such as nginx), and document conversion programs (such as LibreOffice) on the server where SetFN is installed are updated by the server operator. See Checking Server Security Updates for what to check.
- Fixes are shipped as SetFN updates. Keep SetFN on the latest version so that fixes take effect.