openvibers/openvibe.exchange SECURITY.md
SECURITY.md
| 1 | # Security policy |
| 2 | |
| 3 | OpenVibe is run in the open, and we want to hear about security problems before anyone else does. |
| 4 | |
| 5 | ## Reporting a vulnerability |
| 6 | |
| 7 | Email **[email protected]** with "security" in the subject. Please include what you found, where (URL, |
| 8 | repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for |
| 9 | a vulnerability, and do not test against other people's accounts, data or listings. |
| 10 | |
| 11 | We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like. |
| 12 | |
| 13 | ## Scope |
| 14 | |
| 15 | Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.exchange, openvibe.meme, openvibe.today, |
| 16 | openvibe.tools, openvibe.media, openvibe.community, openvibe.games and the other openvibe.* domains) and every |
| 17 | repository under github.com/OpenVibers. Machine-readable contact details are at `/.well-known/security.txt` on each |
| 18 | site. |
| 19 | |
| 20 | ## What OpenVibe.Exchange holds |
| 21 | |
| 22 | - Public listings: the title, summary, description, wants, kind, mode, licence, version, public creator name and |
| 23 | revision, plus the manifest (`name`, `entry`, `runtime`) and the permission passport. None of it is a credential. |
| 24 | - Conformance tests for each listing version and the status events of a listing. |
| 25 | - A person's sandbox trials, installations and the claims/offers they made or received. These are exported and |
| 26 | erased with an account, along with the person's listings. |
| 27 | - Network session tokens only in httpOnly cookies (`exchange_at`, `exchange_rt`); no token is stored in the |
| 28 | database, rendered into a page or logged. |
| 29 | - **No money**: there is no price, no Billing id and no payment credential anywhere in v1. |
| 30 | |
| 31 | A manifest is public metadata. A key or value that looks like a secret (`api_key=`, `token:`, a private key block) |
| 32 | is refused before it is stored, and an unknown manifest key is refused outright. A listing's passport spends must be |
| 33 | empty; a spend is refused by the form, the API and a table check. |
| 34 | |
| 35 | v1 does not execute a listing's code. The sandbox is a manifest/passport dry run, and it says so on the page and in |
| 36 | the API. A real sandbox needs a Run capability and is not part of this version. |
| 37 | |
| 38 | The `/internal/events` account route is loopback only and refuses a proxied request; nginx answers 404 for |
| 39 | `/internal` and `/metrics`. |
| 40 | |
| 41 | ## Supported versions |
| 42 | |
| 43 | Only the current `main` branch, which is what runs in production, receives fixes. |
| 44 |