Skip to content

SECURITY.md

Latest commit

 

History

History
26 lines (18 loc) · 1.28 KB

SECURITY.md

File metadata and controls

26 lines (18 loc) · 1.28 KB
Raw

Security Policy

Reporting a vulnerability

Please report security issues privately - do not open a public issue.

Use GitHub's private vulnerability reporting (Security → Report a vulnerability), or email the maintainers. We'll acknowledge within a few days and keep you updated on a fix.

Scope

Uptime Guard is self-hosted - each deployment holds its own secrets and data. Things especially worth reporting:

  • Authentication bypass (password + TOTP), session token forgery or fixation.
  • Ways to read another project's data, or private data leaking through a public status page (which should only ever expose service names, status, and uptime).
  • Injection via monitor configuration, heartbeat tokens, or the public API.

Hardening notes for operators

  • Set a strong PASSWORD, a unique TOTP_SECRET, and a long random SESSION_SECRET.
  • Rotate SESSION_SECRET (or use Log out other devices in Settings) if a token may be exposed.
  • Keep your private deploy config (wrangler.prod.toml) and .dev.vars out of version control (gitignored by default). The committed wrangler.toml is a placeholder-only template.
  • Treat your Telegram bot token as a secret - rotate it via @BotFather if it leaks.