Really huge mass update; Getting everything up-to-spec and implementing a wide range of features

2026-07-26 14:24:18 +02:00
parent 2c563685bd
commit 8b53698f29
72 changed files with 4275 additions and 693 deletions
@@ -0,0 +1,56 @@
+# Security Policy
+
+PR Previews handles Gitea personal access tokens, AWS credentials, webhook
+secrets, session cookies, SSH private keys, and live deployment logs. Treat
+security issues as sensitive even when they appear limited to a local or
+self-hosted deployment.
+
+## Reporting a Vulnerability
+
+Do not disclose suspected vulnerabilities publicly before they are reviewed.
+
+Report issues through the private channel used by the project maintainers for
+this repository. If you are running your own PP instance, report operational
+incidents to that instance's administrator and rotate affected credentials.
+
+Include:
+
+- A short description of the issue and impact.
+- Steps to reproduce, if safe to share.
+- Affected versions, branches, or commit hashes.
+- Whether any credentials, preview instances, repositories, or logs may have
+  been exposed.
+
+## Supported Versions
+
+Security fixes are made on the active development branch and the current stable
+deployment branch. Older branches are not guaranteed to receive fixes unless a
+maintainer explicitly backports them.
+
+## Sensitive Data Rules
+
+- Never commit `.env`, database dumps, private keys, access tokens, session
+  secrets, webhook secrets, or decrypted credential values.
+- Never paste raw secrets into issues, pull requests, logs, screenshots, or PR
+  preview comments.
+- Rotate Gitea PATs, AWS access keys, webhook secrets, and `SESSION_SECRET` if
+  exposure is suspected.
+- Back up `ENCRYPTION_KEY` securely. Losing it makes stored credentials
+  unreadable; exposing it can expose encrypted secrets if the database is also
+  compromised.
+
+## Security-Sensitive Areas
+
+Review these areas carefully when changing behavior:
+
+- `backend/src/lib/encryption.ts`
+- `backend/src/lib/env.ts`
+- `backend/src/lib/middlewares/auth.ts`
+- `backend/src/routes/webhook.ts`
+- `backend/src/services/deploy.ts`
+- `backend/src/services/ec2.ts`
+- `backend/src/services/gitea.ts`
+- `backend/src/services/ssh.ts`
+
+Preserve constant-time webhook signature checks, encrypted secrets at rest,
+masked deploy logs, and API responses that avoid returning raw secrets.