Initial commit

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security vulnerabilities.**
+
+Report them privately via GitHub's [private vulnerability reporting](https://github.com/ion-design/ditto.site/security/advisories/new)
+("Security" tab → "Report a vulnerability"), or email **samraaj@ion.design**. We'll
+acknowledge within a few business days and keep you updated on the fix.
+
+## Supported versions
+
+This project is pre-1.0; security fixes land on `main`. Pin a commit if you need
+stability.
+
+## Operating a public clone endpoint (read this before deploying)
+
+The service is a **"fetch any URL"** system, so a misconfigured deployment can be
+abused. The codebase ships defenses — keep them on:
+
+- **SSRF protection** (`packages/api/src/ssrf.ts`): every submitted URL is
+  validated and its resolved IPs are checked against private / loopback /
+  link-local / cloud-metadata (`169.254.169.254`) / reserved ranges **after DNS
+  resolution** (covers DNS-rebinding). It's enabled by default — do **not** set
+  `SSRF_DISABLE=true` or `SSRF_ALLOW_LOOPBACK=true` in production.
+- **API-key auth + rate limits**: set `API_KEYS` and `RATE_LIMIT_PER_MINUTE`.
+- **Per-job caps**: the compiler bounds every capture wait; the queue enforces
+  retries/timeouts. Size worker memory for headless Chromium (~0.5–1 GB/clone).
+- **Capture sanity**: degenerate/bot-walled captures are flagged
+  (`capture.pollution` / `capture.blocked`) rather than served as success.
+
+See [`docs/DEPLOY.md`](docs/DEPLOY.md) and [`docs/SERVICE.md`](docs/SERVICE.md).
+
+## Dependency advisories
+
+Dependencies are monitored by [Dependabot](.github/dependabot.yml). One known item:
+the compiler's build harness and the **generated** app pin `next@14.2.21`, which has
+a published advisory. Bumping it should be paired with a benchmark re-run (it affects
+`next build` and the emitted `package.json`), so it's tracked rather than auto-applied.