SECURITY.md (1757B)
1 # Security Policy 2 3 ## Supported versions 4 5 Only the latest commit on `main` is supported. Fixes are not backported. 6 7 ## Reporting a vulnerability 8 9 **Please do not open a public issue for security problems.** 10 11 Report privately through GitHub: 12 <https://github.com/notamitgamer/cdnV2/security/advisories/new> 13 14 Please include: 15 16 - a description of the issue and its impact, 17 - steps to reproduce (a minimal request or proof of concept is ideal), 18 - the commit or deployment you tested against. 19 20 You can expect an acknowledgement within a few days. Please give us reasonable time to ship a fix 21 before disclosing publicly; we are happy to credit you in the advisory if you would like. 22 23 ## Scope 24 25 In scope: this repository's code and its default configuration — in particular the upload guard and 26 rate limiting, the admin dashboard and its token handling, the GitHub OIDC verification 27 (`/api/gh-sync`), the URL-fetching upload (SSRF), the zip packer (path traversal, zip bombs), and the 28 file-serving routes. 29 30 Out of scope: vulnerabilities in third-party services (Hugging Face, GitHub, Cloudflare, Render) or in 31 dependencies with no impact on this project, denial of service by sheer traffic volume, and issues that 32 require a misconfigured deployment (for example running without `TRUST_CF_CONNECTING_IP` behind a 33 proxy and then spoofing IPs). 34 35 ## Hardening tips for operators 36 37 - Set a strong, random `ADMIN_TOKEN`, and a separate `ADMIN_DATA_KEY`. 38 - Use a Hugging Face token scoped to the one bucket, with the minimum permissions needed. 39 - Configure `TRUST_CF_CONNECTING_IP` / `TRUSTED_PROXY_HOPS` correctly, otherwise rate limits and bans 40 can be bypassed or can hit the wrong people. 41 - Keep dependencies up to date (Dependabot is configured in this repository).