SECURITY.md

Security policy

OpenVibe is run in the open, and we want to hear about security problems before anyone else does.

Reporting a vulnerability

Email [email protected] with "security" in the subject. Please include what you found, where (URL,
repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
a vulnerability, and do not test against other people's accounts, data or listings.

We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.

Scope

Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.exchange, openvibe.meme, openvibe.today,
openvibe.tools, openvibe.media, openvibe.community, openvibe.games and the other openvibe.* domains) and every
repository under github.com/OpenVibers. Machine-readable contact details are at /.well-known/security.txt on each
site.

What OpenVibe.Exchange holds

• Public listings: the title, summary, description, wants, kind, mode, licence, version, public creator name and
  revision, plus the manifest (name, entry, runtime) and the permission passport. None of it is a credential.
• Conformance tests for each listing version and the status events of a listing.
• A person's sandbox trials, installations and the claims/offers they made or received. These are exported and
  erased with an account, along with the person's listings.
• Network session tokens only in httpOnly cookies (exchange_at, exchange_rt); no token is stored in the
  database, rendered into a page or logged.
• No money: there is no price, no Billing id and no payment credential anywhere in v1.

A manifest is public metadata. A key or value that looks like a secret (api_key=, token:, a private key block)
is refused before it is stored, and an unknown manifest key is refused outright. A listing's passport spends must be
empty; a spend is refused by the form, the API and a table check.

v1 does not execute a listing's code. The sandbox is a manifest/passport dry run, and it says so on the page and in
the API. A real sandbox needs a Run capability and is not part of this version.

The /internal/events account route is loopback only and refuses a proxied request; nginx answers 404 for
/internal and /metrics.

Supported versions

Only the current main branch, which is what runs in production, receives fixes.