Aller au contenu
Surfski

Security

Ce contenu n’est pas encore disponible dans votre langue.

  • The container publishes only on 127.0.0.1, runs as non-root uid 10001 with a read-only root filesystem, cap_drop: ALL and no-new-privileges, and uses its own network.
  • Docker-published ports bypass host firewalls like ufw. Rely on your cloud firewall or security group: open 80/443 only.
  • Every accounts query is scoped to the caller. Refresh tokens are Fernet-encrypted at rest. Access tokens live only in memory.
  • Logs never contain tokens, auth codes or message bodies. Audit rows record the tool, alias and a short detail only.
  • See SECURITY.md to report a vulnerability.

Synced from rayhu/surfski/README.md@e4c5de0. The repository is the source of truth.