SECURITY.md

main 1.7 KB · 34 lines · markdown

1	# Security policy
2
3	OpenVibe is run in the open, and we want to hear about security problems before anyone else does.
4
5	## Reporting a vulnerability
6
7	Email [email protected] with "security" in the subject. Please include what you found, where (URL,
8	repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
9	a vulnerability, and do not test against other people's accounts, data or streams.
10
11	We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.
12
13	## Scope
14
15	Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.today, openvibe.tools, openvibe.media,
16	openvibe.community, openvibe.games and the other openvibe.* domains) and every repository under
17	github.com/OpenVibers. Machine-readable contact details are at `/.well-known/security.txt` on each site.
18
19	## What OpenVibe.Today holds
20
21	- Events a person scheduled (the title, description, times, timezone, visibility and the Live channel for a stream).
22	- Reminders a person set, and the calendar feed token that makes one URL readable by whoever holds it.
23	- Briefs built from the person's own agenda and the public Rundown.
24	- Receipts of Events deliveries already handled and of account exports/deletions applied.
25	- Network session tokens only in httpOnly cookies (`today_at`, `today_rt`); no token is stored in the database,
26	rendered into a page or logged.
27
28	A feed token is a bearer capability for one person's calendar. The URL is shown only to its owner, rotation makes the
29	old URL a 404 at once, and the token is never exported with an account export.
30
31	## Supported versions
32
33	Only the current `main` branch, which is what runs in production, receives fixes.
34