ditto.site/SECURITY.md

Security Policy

Reporting a vulnerability

Please do not open a public issue for security vulnerabilities.

Report them privately via GitHub's private vulnerability reporting ("Security" tab → "Report a vulnerability"), or email samraaj@ion.design. We'll acknowledge within a few business days and keep you updated on the fix.

Supported versions

This project is pre-1.0; security fixes land on main. Pin a commit if you need stability.

Operating a public clone endpoint (read this before deploying)

The service is a "fetch any URL" system, so a misconfigured deployment can be abused. The codebase ships defenses — keep them on:

• SSRF protection (packages/api/src/ssrf.ts): every submitted URL is validated and its resolved IPs are checked against private / loopback / link-local / cloud-metadata (169.254.169.254) / reserved ranges after DNS resolution (covers DNS-rebinding). It's enabled by default — do not set SSRF_DISABLE=true or SSRF_ALLOW_LOOPBACK=true in production.
• API-key auth + rate limits: set API_KEYS and RATE_LIMIT_PER_MINUTE.
• Per-job caps: the compiler bounds every capture wait; the queue enforces retries/timeouts. Size worker memory for headless Chromium (~0.5–1 GB/clone).
• Capture sanity: degenerate/bot-walled captures are flagged (capture.pollution / capture.blocked) rather than served as success.

See docs/DEPLOY.md and docs/SERVICE.md.

Dependency advisories

Dependencies are monitored by Dependabot. One known item: the compiler's build harness and the generated app pin next@14.2.21, which has a published advisory. Bumping it should be paired with a benchmark re-run (it affects next build and the emitted package.json), so it's tracked rather than auto-applied.