mirror of
https://github.com/andrey271192/Domain_web.git
synced 2026-09-21 14:51:57 +00:00
93109106bc
Bundle geoexport-premium (Docker, docs, Next.js) alongside the working static site mirror; production VPS install still uses site/. Co-authored-by: Cursor <cursoragent@cursor.com>
70 lines
2.2 KiB
Markdown
70 lines
2.2 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
| Version | Supported |
|
|
|---------|-----------|
|
|
| `main` (latest) | Yes |
|
|
| Older tags | Best effort |
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please do not** file public GitHub issues for security problems.
|
|
|
|
1. Email or DM the maintainer with a description and reproduction steps.
|
|
2. Allow up to **90 days** for a fix before public disclosure.
|
|
3. We will acknowledge receipt within **72 hours** when possible.
|
|
|
|
Include:
|
|
|
|
- Affected endpoints or components
|
|
- Impact (data leak, SSRF, RCE, etc.)
|
|
- Proof of concept if available
|
|
- Suggested fix (optional)
|
|
|
|
## Threat model (self-hosted)
|
|
|
|
GeoExport is typically deployed on a private VPS or internal network. Common risks:
|
|
|
|
| Risk | Mitigation |
|
|
|------|------------|
|
|
| Open DNS lookup abuse | Rate-limit `/api/lookup`; block private IP ranges in resolver |
|
|
| SSRF via upstream proxy | Whitelist paths; fixed `GEOEXPORT_UPSTREAM` host only |
|
|
| API scraping / DoS | Redis rate limits; nginx `limit_req` |
|
|
| Leaked `.env` | Never commit secrets; rotate DB passwords on deploy |
|
|
| Outdated geo databases | Monitor `/api/last-update`; automate refresh jobs |
|
|
|
|
## Hardening checklist (production)
|
|
|
|
- [ ] HTTPS only (TLS 1.2+)
|
|
- [ ] `NEXT_PUBLIC_APP_URL` matches real hostname
|
|
- [ ] Strong PostgreSQL password (not compose defaults)
|
|
- [ ] Redis bound to localhost or private network
|
|
- [ ] Firewall: expose only 80/443
|
|
- [ ] Disable directory listing on nginx
|
|
- [ ] Keep Node.js and base images patched (`docker compose pull`)
|
|
|
|
## Dependencies
|
|
|
|
- Run `npm audit` before releases
|
|
- Pin Docker image digests in production compose overrides
|
|
- Subscribe to GitHub security advisories for this repo
|
|
|
|
## Data privacy
|
|
|
|
GeoExport processes **domains and IPs** users submit for lookup. Operators should:
|
|
|
|
- Document retention (if logging lookups)
|
|
- Avoid shipping lookup logs to third parties without consent
|
|
- Prefer self-hosted rule databases over permanent upstream proxy when feasible
|
|
|
|
## Safe defaults
|
|
|
|
- No default API keys in repository
|
|
- Example compose passwords are for **local dev only** — change before internet exposure
|
|
- CSP headers on Next.js responses (planned)
|
|
|
|
## Recognition
|
|
|
|
We credit reporters in release notes when they agree to be named.
|