Security Policy

Security is part of the release contract for yedir-ai. This project handles AI provider keys, OAuth credentials, object-storage URLs, user uploads, generated media, and internal generation workflows, so disclosures should be handled carefully and privately.

Supported Versions

Security fixes are applied to the active main branch and release branches maintained by the project owner. Older experimental branches are not guaranteed to receive patches.

Reporting a Vulnerability

Do not open a public issue for suspected vulnerabilities.

Report privately to the repository owner or project maintainer with:

A short description of the issue and affected area.
Reproduction steps or a minimal proof of concept.
Potential impact, including whether secrets, user data, uploads, signed URLs, or internal APIs are exposed.
Relevant logs with secrets, cookies, Authorization headers, OAuth codes, signed URLs, prompts, base64 data, and private user content removed.

Expected handling:

The maintainer will acknowledge the report when it is received.
Valid issues will be triaged by impact and exploitability.
Fixes should include regression coverage or a documented verification path where practical.
Public disclosure should wait until a fix or mitigation is available.

Sensitive Data Rules

Never commit or paste:

.env.local or real environment variables.
API keys, OAuth client secrets, OAuth codes, cookies, session tokens, Authorization headers, or passwords.
Signed object-storage URLs, raw upload URLs, private bucket paths, or third-party task payloads.
Full prompts, base64 image/video data, or private generated media unless explicitly sanitized.

Use .env.example for placeholders only.

Logging Rules

High-risk server logs should use createLogger from lib/observability/logger. Browser logs should use createClientLogger and stay silent in production unless explicitly enabled.

Before merging security-sensitive changes, run:

pnpm check:quality
pnpm audit:security

For route-level release smoke tests, also run:

AUTH_TRUST_HOST=true PORT=3001 pnpm dev
SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes

If a file starts logging prompts, URLs, provider responses, upload details, OAuth data, or user content, add it to scripts/check-log-hygiene.mjs and ensure pnpm check:logs passes.

Dependency audit risk is tracked in docs/dependency-risk-register.md. Critical/high advisories in runtime dependencies should be remediated or explicitly accepted before production release.

Deployment Security Notes

Configure AUTH_SECRET and production AUTH_URL.
Use AUTH_TRUST_HOST=true only behind a trusted reverse proxy with validated Host headers.
Keep database, storage, OAuth, and AI provider credentials in the deployment secret store.
Prefer short database connect timeouts and bounded connection pools.
Verify /settings remains protected and redirects unauthenticated users to login.

3.0 KiB Raw Blame History