SECURITY.md

main 1.4 KB · 20 lines · markdown

1	# Security
2
3	Report a vulnerability to [email protected], not in a public issue.
4
5	- Tokens. The Network access and refresh tokens live only in httpOnly cookies (`tours_at`, `tours_rt`); the flow
6	state and PKCE verifier in `tours_oauth` (httpOnly, path `/auth`, 10 minutes). No token is stored in the database,
7	rendered in a page or logged. `/auth/me` never returns one.
8	- Sessions. A session token is a Network user token with audience `openvibe.network`; FedCM assertions, app and
9	service tokens are refused. A write made with the session cookie must come from `https://openvibe.tours` itself
10	(`403 tours.cross_site`).
11	- Trips. A trip is the owner's Network `usr_…` subject; a private trip is a 404 to anyone else, a shared one is
12	read-only, and the share slug is random. Account deletion cascades.
13	- Outbound. The source jobs fetch only the fixed public hosts in `server/config.js` (OpenVibe.Live/Rent,
14	Wikivoyage, Wikidata, Wikipedia, Commons, Overpass). No user-chosen URL is fetched. The flight form is a link, not
15	a fetch, and has no affiliate parameter.
16	- Open data. Overpass gets a contact User-Agent, one bounded query per city, a per-host pace and no bulk
17	download. Keys are never needed for a source; a key that is not implemented stays off.
18	- Deploy. `User=ubuntu`, loopback only, `/internal` and `/metrics` are 404 at nginx, and request bodies are
19	never logged.
20