Skip to content

SECURITY.md

Latest commit

 

History

History
54 lines (39 loc) · 2.31 KB

SECURITY.md

File metadata and controls

54 lines (39 loc) · 2.31 KB
Raw

Security Policy

Supported versions

Only the latest main branch receives security updates. This is a young project — pin a commit hash in production and update intentionally.

Reporting a vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Instead, email soeharyo@gmail.com with:

  • A clear description of the vulnerability
  • Steps to reproduce (or a proof-of-concept)
  • The version / commit hash you tested against
  • (Optional) Suggested fix

You'll get an acknowledgment within 72 hours. Critical issues will be patched as fast as I can.

Threat model

DomainMarket is designed to run as a public-facing marketplace. The following are in scope:

Vector In scope? Notes
SQL injection ✅ Eloquent + parameterized queries everywhere. Report any raw query.
XSS (stored / reflected) ✅ Blade auto-escapes; report unescaped output.
CSRF ✅ All POST routes use @csrf. Report missing tokens.
Auth bypass / IDOR ✅ Filament resources should enforce ownership where applicable.
Mass assignment ✅ All models use explicit $fillable.
Open redirect ✅ Report any user-controlled redirect target.
Email enumeration via offer form ✅ Acknowledged trade-off; mitigations welcome.
RCE in dependencies ✅ Dependabot enabled. Report if you spot a pinned vulnerable version.
Brute-force on /admin/login ✅ Should be rate-limited; report if not.
Spam on offer form ⚠️ Captcha / rate-limit is the operator's responsibility for now.
Self-hosted misconfiguration ❌ E.g., publishing .env, running as root, no HTTPS. That's on you.

Hardening checklist for operators

If you're deploying DomainMarket in production:

  • APP_DEBUG=false in .env
  • APP_KEY is unique and not committed
  • Change the default admin password (admin@example.com)
  • Run behind HTTPS (Cloudflare / Caddy / nginx + Let's Encrypt)
  • Use MySQL/Postgres instead of SQLite for any non-trivial load
  • Set up daily DB backups
  • Enable rate limiting on /domain/{name}/offer and /admin/login
  • Run PHP-FPM as a non-root user
  • Keep dependencies up to date (composer audit, npm audit)

Acknowledgments

Security researchers who report valid issues will be credited here (with permission).