SECURITY.md

Security policy

OpenVibe is run in the open, and we want to hear about security problems before anyone else does.

Reporting a vulnerability

Email [email protected] with "security" in the subject. Please include what you found, where (URL,
repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
a vulnerability, and do not test against other people's accounts, data or streams.

We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.

Scope

Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.meme, openvibe.today, openvibe.tools,
openvibe.media, openvibe.community, openvibe.games and the other openvibe.* domains) and every repository under
github.com/OpenVibers. Machine-readable contact details are at /.well-known/security.txt on each site.

What OpenVibe.Meme holds

• Public entries: the title, kind, AI-written summary, status, times and revision. An entry is the network's record,
  not a person's row, so it is not exported or erased with an account.
• Public citations: a verbatim quote from public speech, its sha256, the canonical public URL and the source ids
  (chat message id, VOD/clip id, Rundown segment id). No private VOD bytes, thumbnails or metadata are kept.
• A person's weekly votes, saved caption lines and reports. These are exported and erased with an account.
• Network session tokens only in httpOnly cookies (meme_at, meme_rt); no token is stored in the database,
  rendered into a page or logged.

VOD 5709 and clip 483 are a fixed deny list: no title, thumbnail or quote from either is ever stored, and a
citation naming them is dropped before it is written. A citation URL is re-read daily; a 404 marks it gone.

A caption is plain text lines on a template; v1 never accepts, renders or stores an image uploaded by a person.
The /internal/events account route is loopback only and refuses a proxied request; nginx answers 404 for
/internal and /metrics.

Supported versions

Only the current main branch, which is what runs in production, receives fixes.