The Openlysts team takes security seriously. We appreciate your efforts to responsibly disclose any security vulnerabilities you find.

Please do NOT report security vulnerabilities through public GitHub issues.

1. Private report: Use GitHub's private vulnerability reporting — https://github.com/openlysts/Openlysts/security/advisories/new (no email needed).
2. Subject line: [SECURITY] Brief description
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Type of vulnerability (e.g., SQL injection, XSS, CSRF, authentication bypass)
• Location (URL, endpoint, parameter)
• Impact (what an attacker could achieve)
• Reproduction steps (detailed steps to verify)

• Acknowledgment of your report within 48 hours
• Regular updates on the fix progress
• Credit in the security advisory (unless you prefer anonymity)
• No legal action for good-faith security research

• Password hashing: bcrypt with 12 rounds
• Session management: HTTP-only cookies with secure flags
• Rate limiting: 6 attempts per 15 minutes on auth endpoints
• Account lockout: Temporary lock after 10 failed attempts
• MFA support: TOTP (Google Authenticator) and WebAuthn/Passkeys
• OAuth: Google and GitHub OAuth2 with PKCE

• Parameterized queries: All SQL uses prepared statements
• Input validation: Zod schemas on all API inputs
• Output sanitization: HTML entities escaped, no raw user content
• CORS: Restricted to same-origin in production
• CSP: Content Security Policy headers enabled
• Secrets: Never committed to repository, environment variables only

• HTTPS: Enforced via Vercel/Cloudflare
• Headers: Helmet.js security headers (HSTS, X-Frame-Options, etc.)
• Database: Neon PostgreSQL with SSL, connection pooling
• Serverless: Vercel with isolation, automatic scaling
• Dependencies: Automated vulnerability scanning (npm audit)

• Audit logging: All auth events logged to database
• Error tracking: Generic error messages to users, detailed logs server-side
• Rate limit headers: X-RateLimit-* headers on all responses

• Authentication and authorization flaws
• SQL injection, XSS, CSRF, and other injection attacks
• IDOR (Insecure Direct Object Reference) vulnerabilities
• Session management issues
• Sensitive data exposure
• Server-side request forgery (SSRF)
• Broken access control
• Cryptographic weaknesses
• Security misconfigurations

• Denial of service (DoS) attacks
• Social engineering
• Physical security
• Third-party services (Google, GitHub OAuth)
• Issues in development/local environments only

Always run the latest version for security patches.

1. Never commit secrets — Use environment variables
2. Validate all input — Use Zod schemas
3. Parameterize SQL — Never use string concatenation
4. Escape output — Prevent XSS
5. Rate limit — Protect sensitive endpoints
6. Log auth events — Track suspicious activity
7. Review dependencies — Check for vulnerabilities

• OWASP Top 10
• OWASP API Security Top 10
• Node.js Security Best Practices
• Express Security Best Practices

Thank you for helping keep Openlysts secure! 🔒