2.1 KiB
Security Policy
PR Previews handles Gitea personal access tokens, AWS credentials, webhook secrets, session cookies, SSH private keys, and live deployment logs. Treat security issues as sensitive even when they appear limited to a local or self-hosted deployment.
Reporting a Vulnerability
Do not disclose suspected vulnerabilities publicly before they are reviewed.
Report issues through the private channel used by the project maintainers for this repository. If you are running your own PP instance, report operational incidents to that instance's administrator and rotate affected credentials.
Include:
- A short description of the issue and impact.
- Steps to reproduce, if safe to share.
- Affected versions, branches, or commit hashes.
- Whether any credentials, preview instances, repositories, or logs may have been exposed.
Supported Versions
Security fixes are made on the active development branch and the current stable deployment branch. Older branches are not guaranteed to receive fixes unless a maintainer explicitly backports them.
Sensitive Data Rules
- Never commit
.env, database dumps, private keys, access tokens, session secrets, webhook secrets, or decrypted credential values. - Never paste raw secrets into issues, pull requests, logs, screenshots, or PR preview comments.
- Rotate Gitea PATs, AWS access keys, webhook secrets, and
SESSION_SECRETif exposure is suspected. - Back up
ENCRYPTION_KEYsecurely. Losing it makes stored credentials unreadable; exposing it can expose encrypted secrets if the database is also compromised.
Security-Sensitive Areas
Review these areas carefully when changing behavior:
backend/src/lib/encryption.tsbackend/src/lib/env.tsbackend/src/lib/middlewares/auth.tsbackend/src/routes/webhook.tsbackend/src/services/deploy.tsbackend/src/services/ec2.tsbackend/src/services/gitea.tsbackend/src/services/ssh.ts
Preserve constant-time webhook signature checks, encrypted secrets at rest, masked deploy logs, and API responses that avoid returning raw secrets.