73 lines
3.0 KiB
Markdown
73 lines
3.0 KiB
Markdown
# Security Policy
|
|
|
|
Security is part of the release contract for yedir-ai. This project handles AI provider keys, OAuth credentials, object-storage URLs, user uploads, generated media, and internal generation workflows, so disclosures should be handled carefully and privately.
|
|
|
|
## Supported Versions
|
|
|
|
Security fixes are applied to the active `main` branch and release branches maintained by the project owner. Older experimental branches are not guaranteed to receive patches.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Do not open a public issue for suspected vulnerabilities.
|
|
|
|
Report privately to the repository owner or project maintainer with:
|
|
|
|
- A short description of the issue and affected area.
|
|
- Reproduction steps or a minimal proof of concept.
|
|
- Potential impact, including whether secrets, user data, uploads, signed URLs, or internal APIs are exposed.
|
|
- Relevant logs with secrets, cookies, Authorization headers, OAuth codes, signed URLs, prompts, base64 data, and private user content removed.
|
|
|
|
Expected handling:
|
|
|
|
- The maintainer will acknowledge the report when it is received.
|
|
- Valid issues will be triaged by impact and exploitability.
|
|
- Fixes should include regression coverage or a documented verification path where practical.
|
|
- Public disclosure should wait until a fix or mitigation is available.
|
|
|
|
## Sensitive Data Rules
|
|
|
|
Never commit or paste:
|
|
|
|
- `.env.local` or real environment variables.
|
|
- API keys, OAuth client secrets, OAuth codes, cookies, session tokens, Authorization headers, or passwords.
|
|
- Signed object-storage URLs, raw upload URLs, private bucket paths, or third-party task payloads.
|
|
- Full prompts, base64 image/video data, or private generated media unless explicitly sanitized.
|
|
|
|
Use `.env.example` for placeholders only.
|
|
|
|
## Logging Rules
|
|
|
|
High-risk server logs should use `createLogger` from `lib/observability/logger`. Browser logs should use `createClientLogger` and stay silent in production unless explicitly enabled.
|
|
|
|
Before merging security-sensitive changes, run:
|
|
|
|
```bash
|
|
pnpm check:quality
|
|
pnpm audit:security
|
|
```
|
|
|
|
For route-level release smoke tests, also run:
|
|
|
|
```bash
|
|
AUTH_TRUST_HOST=true PORT=3001 pnpm dev
|
|
SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
|
|
```
|
|
|
|
If a file starts logging prompts, URLs, provider responses, upload details, OAuth data, or user content, add it to `scripts/check-log-hygiene.mjs` and ensure `pnpm check:logs` passes.
|
|
|
|
Dependency audit risk is tracked in `docs/dependency-risk-register.md`. Critical/high advisories in runtime dependencies should be remediated or explicitly accepted before production release.
|
|
|
|
## Deployment Security Notes
|
|
|
|
- Configure `AUTH_SECRET` and production `AUTH_URL`.
|
|
- Use `AUTH_TRUST_HOST=true` only behind a trusted reverse proxy with validated Host headers.
|
|
- Keep database, storage, OAuth, and AI provider credentials in the deployment secret store.
|
|
- Prefer short database connect timeouts and bounded connection pools.
|
|
- Verify `/settings` remains protected and redirects unauthenticated users to login.
|
|
|
|
See also:
|
|
|
|
- `docs/deployment.md`
|
|
- `docs/operations.md`
|
|
- `docs/release-readiness.md`
|