openvibers/openvibe.meme SECURITY.md
SECURITY.md
| 1 | # Security policy |
| 2 | |
| 3 | OpenVibe is run in the open, and we want to hear about security problems before anyone else does. |
| 4 | |
| 5 | ## Reporting a vulnerability |
| 6 | |
| 7 | Email **[email protected]** with "security" in the subject. Please include what you found, where (URL, |
| 8 | repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for |
| 9 | a vulnerability, and do not test against other people's accounts, data or streams. |
| 10 | |
| 11 | We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like. |
| 12 | |
| 13 | ## Scope |
| 14 | |
| 15 | Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.meme, openvibe.today, openvibe.tools, |
| 16 | openvibe.media, openvibe.community, openvibe.games and the other openvibe.* domains) and every repository under |
| 17 | github.com/OpenVibers. Machine-readable contact details are at `/.well-known/security.txt` on each site. |
| 18 | |
| 19 | ## What OpenVibe.Meme holds |
| 20 | |
| 21 | - Public entries: the title, kind, AI-written summary, status, times and revision. An entry is the network's record, |
| 22 | not a person's row, so it is not exported or erased with an account. |
| 23 | - Public citations: a verbatim quote from public speech, its sha256, the canonical public URL and the source ids |
| 24 | (chat message id, VOD/clip id, Rundown segment id). No private VOD bytes, thumbnails or metadata are kept. |
| 25 | - A person's weekly votes, saved caption lines and reports. These are exported and erased with an account. |
| 26 | - Network session tokens only in httpOnly cookies (`meme_at`, `meme_rt`); no token is stored in the database, |
| 27 | rendered into a page or logged. |
| 28 | |
| 29 | VOD 5709 and clip 483 are a fixed deny list: no title, thumbnail or quote from either is ever stored, and a |
| 30 | citation naming them is dropped before it is written. A citation URL is re-read daily; a 404 marks it gone. |
| 31 | |
| 32 | A caption is plain text lines on a template; v1 never accepts, renders or stores an image uploaded by a person. |
| 33 | The `/internal/events` account route is loopback only and refuses a proxied request; nginx answers 404 for |
| 34 | `/internal` and `/metrics`. |
| 35 | |
| 36 | ## Supported versions |
| 37 | |
| 38 | Only the current `main` branch, which is what runs in production, receives fixes. |
| 39 |