Skip to content

Repository navigation

Security: Baconana-chan/rsh.pw-up

Security

SECURITY.md

Security Policy

🔐 Reporting a Vulnerability

If you find a security vulnerability in rsh.pw, please report it privately.

Do not open a public GitHub issue — instead, email: security@rsh.pw

You can expect:

  • Acknowledgment within 48 hours
  • A status update within 5 business days
  • Credit in release notes (if you want)

Please include: a description of the issue, steps to reproduce (or a PoC), and the affected endpoint(s). Screenshots/logs help but are not required.

🛡 Scope

  • Authentication / authorization bypass (OAuth, sessions, API tokens)
  • Cross-site scripting (XSS), including via subdomain names or blog content
  • Injection into sled keys or Cloudflare API calls
  • DNS record manipulation by unauthorized users
  • IDOR — accessing another user's subdomains, payments, wallet, tokens
  • Session hijacking / fixation
  • CSRF on cookie-authenticated mutations
  • Payment fraud: double-crediting, coupon limit bypass, wallet balance manipulation, premium-name race conditions
  • Rate-limit evasion via header spoofing

The following areas have been reviewed with these threats in mind: payment settlement is idempotent (CAS status transitions), coupons enforce max_uses atomically, subdomain/short-link creation claims names via CAS, and all ownership checks return 404/401 for foreign resources.

❌ Out of Scope

  • Volumetric DDoS (mitigated by the Cloudflare proxy)
  • Self-XSS
  • Social engineering of project maintainers
  • Attacks requiring access to the server itself (SSH, host vulnerabilities)
  • Reports from automated scanners without a working proof of impact

💰 Safe Harbor

We will not pursue legal action against researchers who:

  • report vulnerabilities responsibly through this policy,
  • avoid privacy violations, data destruction, and service degradation,
  • do not test against real payment flows beyond minimal verification (use testnets where possible; never move others' funds),
  • give us reasonable time to fix before any public disclosure.

☁️ Infrastructure

  • DNS: managed via Cloudflare API (zone-scoped API tokens)
  • Auth: OAuth 2.0 via GitHub/GitLab (no password storage)
  • Sessions: signed cookies via tower-sessions, persisted server-side
  • DB: embedded sled (local file only, no network exposure); backups recommended as filesystem copies
  • Payments: on-chain USDC only; HD-derived receive addresses, no custodial hot wallet for user funds
  • Secrets: environment variables only (.env, chmod 600), never in the repo

There aren't any published security advisories