trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/SECURITY.md
Ullrich Schäfer be3e69c10b
Security hardening: headers, scanning, Docker, firewall 
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy,
  Permissions-Policy on all responses
- Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403
- CI: Gitleaks secret scanning + pnpm audit for vulnerabilities
- Dependabot: Weekly npm + GitHub Actions + monthly Docker updates
- Docker: Non-root user in journal, planner, and brouter containers
- Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned)
- SECURITY.md: Vulnerability disclosure policy
- Privacy page: Security practices section added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-25 09:58:12 +01:00

1.4 KiB
Raw Blame History

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in trails.cool, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email: security@trails.cool

Include:

  • Description of the vulnerability
  • Steps to reproduce
  • Impact assessment (what could an attacker do?)
  • Any suggested fixes

We will acknowledge your report within 48 hours and provide a timeline for a fix. We aim to resolve critical vulnerabilities within 7 days.

Scope

The following are in scope:

  • trails.cool and planner.trails.cool (production)
  • The trails-cool/trails GitHub repository
  • Authentication, authorization, and session management
  • Data exposure or leakage
  • Server-side vulnerabilities

The following are out of scope:

  • Denial of service attacks
  • Social engineering
  • Self-hosted instances (report to the instance operator)
  • Issues in third-party dependencies (report upstream)

Security Practices

  • Authentication: Passkey (WebAuthn) + magic link login. No passwords stored.
  • Cookies: httpOnly, secure, sameSite=lax
  • Database: Parameterized queries via Drizzle ORM (no raw SQL)
  • Headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options
  • CI: Gitleaks secret scanning, dependency auditing
  • Docker: Non-root containers
  • Monitoring: Sentry error tracking, fail2ban SSH protection