mirror of https://github.com/andrey271192/Domain_web.git synced 2026-09-20 14:41:58 +00:00

Files

Андрей Бобырев 93109106bc feat: add premium Next.js scaffold to Domain_web

Bundle geoexport-premium (Docker, docs, Next.js) alongside the
working static site mirror; production VPS install still uses site/.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-05-24 21:32:59 +03:00

2.2 KiB

Raw Blame History

Security policy

Supported versions

Version	Supported
`main` (latest)	Yes
Older tags	Best effort

Reporting a vulnerability

Please do not file public GitHub issues for security problems.

Email or DM the maintainer with a description and reproduction steps.
Allow up to 90 days for a fix before public disclosure.
We will acknowledge receipt within 72 hours when possible.

Include:

Affected endpoints or components
Impact (data leak, SSRF, RCE, etc.)
Proof of concept if available
Suggested fix (optional)

Threat model (self-hosted)

GeoExport is typically deployed on a private VPS or internal network. Common risks:

Risk	Mitigation
Open DNS lookup abuse	Rate-limit `/api/lookup`; block private IP ranges in resolver
SSRF via upstream proxy	Whitelist paths; fixed `GEOEXPORT_UPSTREAM` host only
API scraping / DoS	Redis rate limits; nginx `limit_req`
Leaked `.env`	Never commit secrets; rotate DB passwords on deploy
Outdated geo databases	Monitor `/api/last-update`; automate refresh jobs

Hardening checklist (production)

HTTPS only (TLS 1.2+)
NEXT_PUBLIC_APP_URL matches real hostname
Strong PostgreSQL password (not compose defaults)
Redis bound to localhost or private network
Firewall: expose only 80/443
Disable directory listing on nginx
Keep Node.js and base images patched (docker compose pull)

Dependencies

Run npm audit before releases
Pin Docker image digests in production compose overrides
Subscribe to GitHub security advisories for this repo

Data privacy

GeoExport processes domains and IPs users submit for lookup. Operators should:

Document retention (if logging lookups)
Avoid shipping lookup logs to third parties without consent
Prefer self-hosted rule databases over permanent upstream proxy when feasible

Safe defaults

No default API keys in repository
Example compose passwords are for local dev only — change before internet exposure
CSP headers on Next.js responses (planned)

Recognition

We credit reporters in release notes when they agree to be named.

2.2 KiB Raw Blame History