SECURITY.md

main 3.2 KB · 50 lines · markdown

1	# Security policy
2
3	OpenVibe is run in the open, and we want to hear about security problems before anyone else does.
4
5	## Reporting a vulnerability
6
7	Email [email protected] with "security" in the subject. Please include what you found, where (URL,
8	repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
9	a vulnerability, and do not test against other people's accounts, data or streams.
10
11	We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.
12
13	## Scope
14
15	Every OpenVibe service and site (connect.openvibe.link and every <name>--<user>.openvibe.link, the old
16	connect.openvibe.website and every <name>--<user>.openvibe.website alias, openvibe.live, openvibe.network,
17	openvibe.today, openvibe.tools, openvibe.media, openvibe.community, openvibe.games and the other openvibe.* domains)
18	and every repository under github.com/OpenVibers. Machine-readable contact details are at `/.well-known/security.txt`
19	on each site.
20
21	## What OpenVibe Connect holds
22
23	- A person's shares: their subject id and username, the share's name and address, the local port they typed, who may
24	open it, its status, counters (requests, bytes) and times. The connect key is stored only as a SHA-256 hash of a
25	32-byte random value; the key itself is shown once and never stored, logged or rendered again.
26	- Visits: one row per share, person and day with a request count and a "turned away" count. No IP address, no path, no
27	query string, no header, no body.
28	- Nothing that passes through a share is stored. Requests and responses stream through memory.
29	- Network session tokens only in httpOnly cookies; no token is stored in the database, rendered into a page or logged.
30
31	## How a share is protected
32
33	- The gate. Every visitor signs in with OpenVibe and must be allowed by the share's policy (only the owner, the
34	owner and named people, or anyone signed in). There are no public shares: those wait for the abuse check and the
35	Public Suffix List entry for openvibe.link (ADR-057, CON-9 and CON-21). Because anyone can make an OpenVibe
36	account, "anyone signed in" is open to OpenVibe staff only until then.
37	- Host-only cookies. The gate's cookie on a share host is `__Host-ovc` (Secure, HttpOnly, SameSite=Lax, Path=/, no
38	Domain), HMAC-signed and bound to that share and its policy version; changing the policy invalidates every cookie.
39	A Set-Cookie from the shared app loses any Domain attribute, and the app can never set or read the gate's cookie.
40	- The share comes from the Host header nginx sets, never from X-Forwarded-Host or any other visitor header; a
41	visitor's X-OpenVibe-* headers are dropped before the app sees the request.
42	- No cache past the gate. Every share response carries `Cloudflare-CDN-Cache-Control: no-store` and a private
43	Cache-Control.
44	- The client reaches localhost only, on the port its owner gave it; the server cannot make it connect anywhere else.
45	- Limits: five open shares per person, 64 requests at once and 1,200 a minute per share, 100 MB per request body,
46	10 GB a day per person.
47
48	Please report anything that gets a visitor past the gate, lets one share read another's cookies, or makes a client
49	reach anything but its own port.
50