57 lines
2.1 KiB
Markdown
57 lines
2.1 KiB
Markdown
# Security Policy
|
|
|
|
PR Previews handles Gitea personal access tokens, AWS credentials, webhook
|
|
secrets, session cookies, SSH private keys, and live deployment logs. Treat
|
|
security issues as sensitive even when they appear limited to a local or
|
|
self-hosted deployment.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Do not disclose suspected vulnerabilities publicly before they are reviewed.
|
|
|
|
Report issues through the private channel used by the project maintainers for
|
|
this repository. If you are running your own PP instance, report operational
|
|
incidents to that instance's administrator and rotate affected credentials.
|
|
|
|
Include:
|
|
|
|
- A short description of the issue and impact.
|
|
- Steps to reproduce, if safe to share.
|
|
- Affected versions, branches, or commit hashes.
|
|
- Whether any credentials, preview instances, repositories, or logs may have
|
|
been exposed.
|
|
|
|
## Supported Versions
|
|
|
|
Security fixes are made on the active development branch and the current stable
|
|
deployment branch. Older branches are not guaranteed to receive fixes unless a
|
|
maintainer explicitly backports them.
|
|
|
|
## Sensitive Data Rules
|
|
|
|
- Never commit `.env`, database dumps, private keys, access tokens, session
|
|
secrets, webhook secrets, or decrypted credential values.
|
|
- Never paste raw secrets into issues, pull requests, logs, screenshots, or PR
|
|
preview comments.
|
|
- Rotate Gitea PATs, AWS access keys, webhook secrets, and `SESSION_SECRET` if
|
|
exposure is suspected.
|
|
- Back up `ENCRYPTION_KEY` securely. Losing it makes stored credentials
|
|
unreadable; exposing it can expose encrypted secrets if the database is also
|
|
compromised.
|
|
|
|
## Security-Sensitive Areas
|
|
|
|
Review these areas carefully when changing behavior:
|
|
|
|
- `backend/src/lib/encryption.ts`
|
|
- `backend/src/lib/env.ts`
|
|
- `backend/src/lib/middlewares/auth.ts`
|
|
- `backend/src/routes/webhook.ts`
|
|
- `backend/src/services/deploy.ts`
|
|
- `backend/src/services/ec2.ts`
|
|
- `backend/src/services/gitea.ts`
|
|
- `backend/src/services/ssh.ts`
|
|
|
|
Preserve constant-time webhook signature checks, encrypted secrets at rest,
|
|
masked deploy logs, and API responses that avoid returning raw secrets.
|