ditto.site/SECURITY.md

Security Policy

Reporting a vulnerability

Please do not open a public issue for security vulnerabilities.

Report them privately via GitHub's private vulnerability reporting ("Security" tab → "Report a vulnerability"), or email samraaj@ion.design. We'll acknowledge within a few business days and keep you updated on the fix.

Supported versions

This project is pre-1.0; security fixes land on main. Pin a commit if you need stability.

Operating a public clone endpoint (read this before deploying)

The service is a "fetch any URL" system, so a misconfigured deployment can be abused. The codebase ships defenses — keep them on:

• SSRF protection (packages/api/src/ssrf.ts): every submitted URL is validated and its resolved IPs are checked against private / loopback / link-local / cloud-metadata (169.254.169.254) / reserved ranges after DNS resolution (covers DNS-rebinding). It's enabled by default — do not set SSRF_DISABLE=true or SSRF_ALLOW_LOOPBACK=true in production.
• API-key auth + rate limits: set API_KEYS and RATE_LIMIT_PER_MINUTE.
• Per-job caps: the compiler bounds every capture wait; the queue enforces retries/timeouts. Size worker memory for headless Chromium (~0.5–1 GB/clone).
• Capture sanity: degenerate/bot-walled captures are flagged (capture.pollution / capture.blocked) rather than served as success.

See docs/DEPLOY.md and docs/SERVICE.md.

Dependency advisories

Dependencies are monitored by Dependabot. Use npm audit --omit=dev --audit-level=moderate for runtime dependency checks.

Known residual items:

• A full npm audit reports a moderate esbuild advisory through drizzle-kit -> @esbuild-kit/esm-loader -> @esbuild-kit/core-utils. This is a development-only migration generator path. The audit-suggested downgrade to drizzle-kit@0.18.1 breaks the current drizzle-kit generate workflow, so do not run npm audit fix --force blindly.
• Generated Next.js apps use the current Next 15 line instead of the older 14.x template. npm may still report a moderate PostCSS advisory inherited through Next until the upstream package carries a patched PostCSS version.

Generated apps are static exports by default. Review and update their package.json before operating them as long-lived public services.