openvibers/openvibe.fun SECURITY.md
SECURITY.md
| 1 | # Security policy |
| 2 | |
| 3 | OpenVibe is run in the open, and we want to hear about security problems before anyone else does. |
| 4 | |
| 5 | ## Reporting a vulnerability |
| 6 | |
| 7 | Email **[email protected]** with "security" in the subject. Please include what you found, where (URL, |
| 8 | repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for |
| 9 | a vulnerability, and do not test against other people's accounts, data or streams. |
| 10 | |
| 11 | We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like. |
| 12 | |
| 13 | ## Scope |
| 14 | |
| 15 | Every OpenVibe service and site (openvibe.fun, openvibe.live, openvibe.network, openvibe.today, openvibe.tools, |
| 16 | openvibe.media, openvibe.community, openvibe.games and the other openvibe.* domains) and every repository under |
| 17 | github.com/OpenVibers. Machine-readable contact details are at `/.well-known/security.txt` on each site. |
| 18 | |
| 19 | ## What OpenVibe.Fun holds |
| 20 | |
| 21 | - Public quests and boards: the title, brief, category, place/city/point, accessibility mark, status, streamer |
| 22 | username and reward id. A public quest is the community's record, not one person's private row. |
| 23 | - Public group plans: title, summary, city/point, time, timezone, options, public vote counts and the winner. |
| 24 | - A person's suggestions, votes, verification checks, badges, OpenCoin reward ledger, plans they started, plan |
| 25 | options they proposed, plan votes and reports. These are exported and erased with an account; the public quest or |
| 26 | shared plan stays with the author column set to NULL. |
| 27 | - A one-way key of the public chat username and the public message id for the read-only chat commands. A chat |
| 28 | message's text is not stored, and Fun never posts a message. A chat vote is not linked to a Network subject, so |
| 29 | it is not exportable by account, but it is also not stored as the plaintext username. |
| 30 | - Network session tokens only in httpOnly cookies (`fun_at`, `fun_rt`); no token is stored in the database, |
| 31 | rendered into a page or logged. The Today call uses the person's own token and never stores it. |
| 32 | - OSM and Ticketmaster answers in `fun_geo_cache`: public place/event JSON, no person and no secret. The Ticketmaster |
| 33 | key is a query parameter at the edge, never a cache key, a response field or a log line. |
| 34 | |
| 35 | ## Safety |
| 36 | |
| 37 | Every suggestion and chat suggestion is checked against a small dangerous/illegal/trespassing/harassment/adult |
| 38 | filter before it is stored. A streamer can make a board accessible-only and cap suggestions. The chat verification |
| 39 | needs distinct public chat voters or a Network moderator. Any public quest or plan can be reported by a signed-in |
| 40 | person; staff can hide it. A hidden target answers 404 and writes a Search tombstone. |
| 41 | |
| 42 | No Fun route needs a service token. A signed-in write from the session cookie must come from `openvibe.fun` |
| 43 | (Sec-Fetch-Site same-origin or an Origin equal to ours); anonymous and cross-site writes are refused. `/internal/events` |
| 44 | is loopback only and refuses a proxied request; nginx answers 404 for `/internal` and `/metrics`. The OBS overlay is |
| 45 | `noindex, nofollow` and has no script. |
| 46 | |
| 47 | ## Supported versions |
| 48 | |
| 49 | Only the current `main` branch, which is what runs in production, receives fixes. |
| 50 |