be3e69c10b
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy on all responses - Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403 - CI: Gitleaks secret scanning + pnpm audit for vulnerabilities - Dependabot: Weekly npm + GitHub Actions + monthly Docker updates - Docker: Non-root user in journal, planner, and brouter containers - Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned) - SECURITY.md: Vulnerability disclosure policy - Privacy page: Security practices section added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
44 lines
1.4 KiB
Markdown
44 lines
1.4 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in trails.cool, please report it
|
|
responsibly.
|
|
|
|
**Do NOT open a public GitHub issue for security vulnerabilities.**
|
|
|
|
Instead, please email: **security@trails.cool**
|
|
|
|
Include:
|
|
- Description of the vulnerability
|
|
- Steps to reproduce
|
|
- Impact assessment (what could an attacker do?)
|
|
- Any suggested fixes
|
|
|
|
We will acknowledge your report within 48 hours and provide a timeline for
|
|
a fix. We aim to resolve critical vulnerabilities within 7 days.
|
|
|
|
## Scope
|
|
|
|
The following are in scope:
|
|
- trails.cool and planner.trails.cool (production)
|
|
- The trails-cool/trails GitHub repository
|
|
- Authentication, authorization, and session management
|
|
- Data exposure or leakage
|
|
- Server-side vulnerabilities
|
|
|
|
The following are out of scope:
|
|
- Denial of service attacks
|
|
- Social engineering
|
|
- Self-hosted instances (report to the instance operator)
|
|
- Issues in third-party dependencies (report upstream)
|
|
|
|
## Security Practices
|
|
|
|
- **Authentication**: Passkey (WebAuthn) + magic link login. No passwords stored.
|
|
- **Cookies**: httpOnly, secure, sameSite=lax
|
|
- **Database**: Parameterized queries via Drizzle ORM (no raw SQL)
|
|
- **Headers**: HSTS, CSP, X-Frame-Options, X-Content-Type-Options
|
|
- **CI**: Gitleaks secret scanning, dependency auditing
|
|
- **Docker**: Non-root containers
|
|
- **Monitoring**: Sentry error tracking, fail2ban SSH protection
|