SECURITY.md

main 2.0 KB · 37 lines · markdown

1	# Security policy
2
3	OpenVibe is run in the open, and we want to hear about security problems before anyone else does.
4
5	## Reporting a vulnerability
6
7	Email [email protected] with "security" in the subject. Please include what you found, where (URL,
8	repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
9	a vulnerability, and do not test against other people's accounts, projects, jobs or data.
10
11	We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.
12
13	## Scope
14
15	Every OpenVibe service and site (openvibe.run, openvibe.live, openvibe.network, openvibe.tools, openvibe.media,
16	openvibe.bot and the other openvibe.* domains) and every repository under github.com/OpenVibers. Machine-readable
17	contact details are at `/.well-known/security.txt` on each site.
18
19	## This service
20
21	OpenVibe.Run executes other people's work and its usage is billed, so a defect here is money and execution. What
22	Run guarantees, and what a report should assume:
23
24	- every route checks exactly one capability from the caller's Network service token (audience `openvibe.run`), and
25	a job's project and requester come from that token — never from a request body or a query string;
26	- another project's job is always `404` (`run.job_not_found`), never `403`: Run never confirms that an id exists;
27	- request bodies and query strings are validated against the released `openvibe-contracts` schemas, and so is every
28	answer before it is sent;
29	- `GET /api/v1/jobs/:id/stream` accepts only a two-minute, single-use ticket that Run itself signed for that one job
30	(audience `openvibe.run`, `typ run-stream`) — never a service token in a query string;
31	- no secret is logged: not the `Authorization` header, not a stream ticket, not a job's stdout;
32	- nothing starts at module load (timers, relays and listeners start in `server/index.js` `main()`).
33
34	## Supported versions
35
36	Only the current `main` branch, which is what runs in production, receives fixes.
37