SECURITY.md

Security policy

OpenVibe is run in the open, and we want to hear about security problems before anyone else does.

Reporting a vulnerability

Email [email protected] with "security" in the subject. Please include what you found, where (URL,
repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
a vulnerability, and do not test against other people's accounts, data or streams.

We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.

Scope

Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.today, openvibe.tools, openvibe.media,
openvibe.community, openvibe.games and the other openvibe.* domains) and every repository under
github.com/OpenVibers. Machine-readable contact details are at /.well-known/security.txt on each site.

What OpenVibe.Today holds

• Events a person scheduled (the title, description, times, timezone, visibility and the Live channel for a stream).
• Reminders a person set, and the calendar feed token that makes one URL readable by whoever holds it.
• Briefs built from the person's own agenda and the public Rundown.
• Receipts of Events deliveries already handled and of account exports/deletions applied.
• Network session tokens only in httpOnly cookies (today_at, today_rt); no token is stored in the database,
  rendered into a page or logged.

A feed token is a bearer capability for one person's calendar. The URL is shown only to its owner, rotation makes the
old URL a 404 at once, and the token is never exported with an account export.

Supported versions

Only the current main branch, which is what runs in production, receives fixes.