tillandClaude Opus 5
61e9f4de5a
CI / check (push) Has been cancelled
The file named security@heidrich-digital.de, which I had assumed rather than checked — a security contact that bounces is worse than none. Replaced with the maintainer's actual address. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
2.0 KiB
2.0 KiB
Security
Reporting a vulnerability
Please do not open a public issue. Mail mail@tillheidrich.de with what you found and how to reproduce it. You will get an acknowledgement within a few days. There is no bounty programme — this is a one-person project — but credit in the release notes is yours if you want it.
What Klarbild already does
- Passwords are hashed with argon2. Stored credentials (SMTP, delivery targets,
API keys) are encrypted with AES-256-GCM using
ENCRYPTION_KEY, never written in plain text. - Sessions are a signed cookie plus a server-side check. Changing a password or a role invalidates every open session; the role comes from the database, not from the cookie.
- Content-Security-Policy with per-script hashes rather than
'unsafe-inline', set at build time.style-srckeeps'unsafe-inline'because React writes styles as element attributes, which cannot be hashed — a narrower class of problem than script injection, which stays closed. - Remote paths are validated immediately before writing, not somewhere upstream:
posixpath.join('/customers/acme', '../../../etc/cron.d')is/etc/cron.d, and the upload would have created the directory first. SeesafeSegmentinsrc/lib/remotetarget.tsand its tests. - Share links: expiry, revocation, optional argon2 passphrase with a rate limit,
noindex, and access bound to the link rather than to the image. Visit logging hashes the IP with a server secret and the link id, keeps one row per visitor per hour, and deletes after 90 days. - A module that is switched off returns 404, not 403.
What it does not do
- There is no multi-tenant isolation. Every account on an instance is on the same
instance; roles are
userandadminand that is the whole model. - Klarbild expects to run behind a reverse proxy that terminates TLS. It does not do TLS itself.
ENCRYPTION_KEYhas no rotation path yet. Losing it means re-entering the stored credentials.
Supported versions
The latest release. There is no long-term support branch.