SECURITY.md

Security

Report a vulnerability to [email protected], not in a public issue.

• Tokens. The Network access and refresh tokens live only in httpOnly cookies (tours_at, tours_rt); the flow
  state and PKCE verifier in tours_oauth (httpOnly, path /auth, 10 minutes). No token is stored in the database,
  rendered in a page or logged. /auth/me never returns one.
• Sessions. A session token is a Network user token with audience openvibe.network; FedCM assertions, app and
  service tokens are refused. A write made with the session cookie must come from https://openvibe.tours itself
  (403 tours.cross_site).
• Trips. A trip is the owner's Network usr_… subject; a private trip is a 404 to anyone else, a shared one is
  read-only, and the share slug is random. Account deletion cascades.
• Outbound. The source jobs fetch only the fixed public hosts in server/config.js (OpenVibe.Live/Rent,
  Wikivoyage, Wikidata, Wikipedia, Commons, Overpass). No user-chosen URL is fetched. The flight form is a link, not
  a fetch, and has no affiliate parameter.
• Open data. Overpass gets a contact User-Agent, one bounded query per city, a per-host pace and no bulk
  download. Keys are never needed for a source; a key that is not implemented stays off.
• Deploy. User=ubuntu, loopback only, /internal and /metrics are 404 at nginx, and request bodies are
  never logged.