MrAlders0n
f2728b059b
* docs: move design and API contract into docs/ * docs: add releases and versioning page * docs: add configuration reference for server and web * docs: add reverse proxy page * docs: add upgrading page * docs: add operations page and move backup and profiling docs * docs: add getting packets in and security pages * docs: add troubleshooting page * docs(api): fold admin, activity, route and summary notes into the contract * docs(deploy): add type 2 split deployment, finish the beacon rename, ignore secrets * docs: rewrite README as the front door and share the contributor workflow * docs: remove em dashes from prose and config comments * docs: apply review fixes to type 2, upgrading, troubleshooting and first-run notes * docs: fix upgrade order, restore steps, type 2 setup and contract details from review * docs: keep the gitignore to deployment secrets and runtime state
1.5 KiB
Security Policy
This is the documentation and deployment repository for Beacon. If you have found a vulnerability in the Beacon application itself (server or web), please report it against the relevant code repository:
Reporting a Vulnerability
Please do not report security issues through public GitHub. Issues are disabled on this repository.
Instead, contact the maintainers directly via the MeshCore Canada Discord server: MeshCore Canada Discord; reach out to dedskelly directly. Include as much detail as possible: the nature of the issue, steps to reproduce, and any potential impact.
We will acknowledge receipt within 48 hours and aim to provide a fix or mitigation within 14 days depending on severity.
Once a fix is released we will publish a security advisory on the relevant repository.
Deployment hardening
The Docker deployments in this repo expose db, redis, and app only on
127.0.0.1, with Caddy terminating TLS on ports 80/443. Beacon's REST reads
and WebSocket feed are public by design; only /api/v1/admin/* needs a bearer
key (BEACON_API_KEY), and abuse is limited by per-IP rate limits. It is
intended to sit behind that reverse proxy, listed in server.trusted_proxies.
Keep this in mind when assessing the severity of any findings, and never expose
the database, Redis, or the raw app port to the public internet.