mirror of
https://github.com/MeshCore-Beacon/beacon-docs.git
synced 2026-10-24 03:22:29 +00:00
MrAlders0n
f2728b059b
* docs: move design and API contract into docs/ * docs: add releases and versioning page * docs: add configuration reference for server and web * docs: add reverse proxy page * docs: add upgrading page * docs: add operations page and move backup and profiling docs * docs: add getting packets in and security pages * docs: add troubleshooting page * docs(api): fold admin, activity, route and summary notes into the contract * docs(deploy): add type 2 split deployment, finish the beacon rename, ignore secrets * docs: rewrite README as the front door and share the contributor workflow * docs: remove em dashes from prose and config comments * docs: apply review fixes to type 2, upgrading, troubleshooting and first-run notes * docs: fix upgrade order, restore steps, type 2 setup and contract details from review * docs: keep the gitignore to deployment secrets and runtime state
35 lines
1.5 KiB
Markdown
35 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
This is the **documentation and deployment** repository for Beacon. If you have
|
|
found a vulnerability in the Beacon application itself (server or web), please
|
|
report it against the relevant code repository:
|
|
|
|
- [beacon-server](https://github.com/MeshCore-Beacon/beacon-server)
|
|
- [beacon-web](https://github.com/MeshCore-Beacon/beacon-web)
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please do not report security issues through public GitHub. Issues are disabled
|
|
on this repository.
|
|
|
|
Instead, contact the maintainers directly via the MeshCore Canada Discord
|
|
server: [MeshCore Canada Discord](https://discord.gg/Gz3KvJx2hf); reach out to
|
|
**dedskelly** directly. Include as much detail as possible: the nature of the
|
|
issue, steps to reproduce, and any potential impact.
|
|
|
|
We will acknowledge receipt within 48 hours and aim to provide a fix or
|
|
mitigation within 14 days depending on severity.
|
|
|
|
Once a fix is released we will publish a security advisory on the relevant
|
|
repository.
|
|
|
|
## Deployment hardening
|
|
|
|
The Docker deployments in this repo expose `db`, `redis`, and `app` only on
|
|
`127.0.0.1`, with Caddy terminating TLS on ports 80/443. Beacon's REST reads
|
|
and WebSocket feed are public by design; only `/api/v1/admin/*` needs a bearer
|
|
key (`BEACON_API_KEY`), and abuse is limited by per-IP rate limits. It is
|
|
intended to sit behind that reverse proxy, listed in `server.trusted_proxies`.
|
|
Keep this in mind when assessing the severity of any findings, and never expose
|
|
the database, Redis, or the raw app port to the public internet.
|