SECURITY.md

main 2.7 KB · 43 lines · markdown

1	# Security policy
2
3	OpenVibe is run in the open, and we want to hear about security problems before anyone else does.
4
5	## Reporting a vulnerability
6
7	Email [email protected] with "security" in the subject. Please include what you found, where (URL,
8	repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
9	a vulnerability, and do not test against other people's cameras, grants, pictures or streams.
10
11	We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.
12
13	## Scope
14
15	Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.cam, openvibe.media, openvibe.pics and
16	the other openvibe.* domains) and every repository under github.com/OpenVibers. Machine-readable contact details
17	are at `/.well-known/security.txt` on each site.
18
19	## What OpenVibe.Cam holds
20
21	- A paired camera: its name, source, status, Live stream id and slot, the owner's username and note, and times. It
22	is private to its owner; there is no public camera page in v1.
23	- A viewer grant: the camera, the owner's subject, the viewer's subject and username, its grant and expiry times,
24	and a revocation time and author. It is not a secret, but it is the only thing that opens a wall.
25	- A photo or a still: the person's subject, a camera or stream/slot, the filter name and caption, and OpenVibe.Pics'
26	slug, page link and direct link. No picture bytes, no face template and no identity classification are stored
27	here. The picture itself is OpenVibe.Pics' and follows Pics' own access rules, re-encoding and takedowns.
28	- Network session tokens only in httpOnly cookies (`cam_at`, `cam_rt`). The token is forwarded to OpenVibe.Pics when
29	the person saves a picture; it is never stored in the database, rendered into a page or logged.
30
31	A wall answers 404 whether the camera does not exist or the caller has no active grant, so a stranger cannot probe
32	for one. Staff have no bypass: a Network `global_mod` without a grant is refused like anyone else. A session write
33	must come from `openvibe.cam` (Sec-Fetch-Site same-origin, or an Origin equal to ours); a cross-site form cannot
34	pair a camera, grant a viewer, revoke a grant or upload a photo. The `/internal/events` account route is loopback
35	only and refuses a proxied request; nginx answers 404 for `/internal` and `/metrics`.
36
37	There is no stranger search and no nudity or violence classifier, no AI call and no recording in v1. The camera is
38	same-origin only (`Permissions-Policy: camera=(self), microphone=()`), and the filter runs in the browser.
39
40	## Supported versions
41
42	Only the current `main` branch, which is what runs in production, receives fixes.
43