40 lines
1.9 KiB
Markdown
40 lines
1.9 KiB
Markdown
# Security Policy
|
||
|
||
## Reporting a vulnerability
|
||
|
||
**Please do not open a public issue for security vulnerabilities.**
|
||
|
||
Report them privately via GitHub's [private vulnerability reporting](https://github.com/ion-design/ditto.site/security/advisories/new)
|
||
("Security" tab → "Report a vulnerability"), or email **samraaj@ion.design**. We'll
|
||
acknowledge within a few business days and keep you updated on the fix.
|
||
|
||
## Supported versions
|
||
|
||
This project is pre-1.0; security fixes land on `main`. Pin a commit if you need
|
||
stability.
|
||
|
||
## Operating a public clone endpoint (read this before deploying)
|
||
|
||
The service is a **"fetch any URL"** system, so a misconfigured deployment can be
|
||
abused. The codebase ships defenses — keep them on:
|
||
|
||
- **SSRF protection** (`packages/api/src/ssrf.ts`): every submitted URL is
|
||
validated and its resolved IPs are checked against private / loopback /
|
||
link-local / cloud-metadata (`169.254.169.254`) / reserved ranges **after DNS
|
||
resolution** (covers DNS-rebinding). It's enabled by default — do **not** set
|
||
`SSRF_DISABLE=true` or `SSRF_ALLOW_LOOPBACK=true` in production.
|
||
- **API-key auth + rate limits**: set `API_KEYS` and `RATE_LIMIT_PER_MINUTE`.
|
||
- **Per-job caps**: the compiler bounds every capture wait; the queue enforces
|
||
retries/timeouts. Size worker memory for headless Chromium (~0.5–1 GB/clone).
|
||
- **Capture sanity**: degenerate/bot-walled captures are flagged
|
||
(`capture.pollution` / `capture.blocked`) rather than served as success.
|
||
|
||
See [`docs/DEPLOY.md`](docs/DEPLOY.md) and [`docs/SERVICE.md`](docs/SERVICE.md).
|
||
|
||
## Dependency advisories
|
||
|
||
Dependencies are monitored by [Dependabot](.github/dependabot.yml). One known item:
|
||
the compiler's build harness and the **generated** app pin `next@14.2.21`, which has
|
||
a published advisory. Bumping it should be paired with a benchmark re-run (it affects
|
||
`next build` and the emitted `package.json`), so it's tracked rather than auto-applied.
|