SECURITY.md

main 2.0 KB · 38 lines · markdown

1	# Security policy
2
3	OpenVibe is run in the open, and we want to hear about security problems before anyone else does.
4
5	## Reporting a vulnerability
6
7	Email [email protected] with "security" in the subject. Please include what you found, where (URL,
8	repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
9	a vulnerability, and do not test against other people's accounts, data or streams.
10
11	We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.
12
13	## Scope
14
15	Every OpenVibe service and site (open.shoes, openvibe.live, openvibe.network, openvibe.today, openvibe.tools,
16	openvibe.media, openvibe.community, openvibe.games and the other openvibe.* domains) and every repository under
17	github.com/OpenVibers. Machine-readable contact details are at `/.well-known/security.txt` on each site.
18
19	## What OpenVibe.Shoes holds
20
21	- Public models, offers, daily snapshots, drops and cited facts: the stores' public listings, prices, all-in
22	inputs, sizes, conditions, colourways, source pages, check times and read times. They are the network's public
23	record, not a person's row, so they are not exported or erased with an account.
24	- A person's watches: the subject id, the kind (a price watch or a pasted link), the model/size/condition, the
25	threshold and a public URL. These are exported and erased with an account.
26	- Network session tokens only in httpOnly cookies (`shoes_at`, `shoes_rt`); no token is stored in the database,
27	rendered into a page or logged. The Watch service token and eBay key pair are environment values and never
28	stored or logged.
29	- A pasted URL is checked by `openvibe-shared/egress` before it is handed to Watch; Shoes never fetches the URL
30	itself, and Facebook Marketplace is never scraped.
31
32	The `/internal/events` account route is loopback only and refuses a proxied request; nginx answers 404 for
33	`/internal` and `/metrics`.
34
35	## Supported versions
36
37	Only the current `main` branch, which is what runs in production, receives fixes.
38