mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
42 lines
1.6 KiB
Markdown
42 lines
1.6 KiB
Markdown
|
# Security Policy
|
||
|
|
|
||
|
|
Security guidelines and vulnerability reporting for OwnCord.
|
||
|
|
|
||
|
|
## Reporting Vulnerabilities
|
||
|
|
|
||
|
|
Use GitHub Security Advisories to report vulnerabilities: go to Settings > Security > Advisories and create a new advisory.
|
||
|
|
|
||
|
|
**Do NOT open public issues for security bugs.**
|
||
|
|
|
||
|
|
## Response Timeline
|
||
|
|
|
||
|
|
- **Acknowledgment:** Within 48 hours
|
||
|
|
- **Critical fixes:** Within 7 days
|
||
|
|
- **Non-critical fixes:** Included in the next release
|
||
|
|
|
||
|
|
## Two-Factor Authentication
|
||
|
|
|
||
|
|
OwnCord supports TOTP-based 2FA:
|
||
|
|
|
||
|
|
- Users enroll via Settings > Account (QR code + backup codes)
|
||
|
|
- Admins can enforce server-wide 2FA via the `require_2fa` setting in the admin panel
|
||
|
|
- `require_2fa` requires all users to have 2FA enabled and registration to be closed
|
||
|
|
- Login flow returns `requires_2fa: true` with a `partial_token` (10-min TTL, 5-attempt limit)
|
||
|
|
- Auth challenges are rate-limited to 10 req/min per IP
|
||
|
|
|
||
|
|
## Known Limitations
|
||
|
|
|
||
|
|
- No code signing yet -- binaries are verified via SHA256 checksums only
|
||
|
|
|
||
|
|
## Security Hardening Checklist for Operators
|
||
|
|
|
||
|
|
- [ ] Enable TLS (self-signed is the default; custom certs recommended for production)
|
||
|
|
- [ ] Keep invite-only registration enabled (default)
|
||
|
|
- [ ] Set a strong admin password
|
||
|
|
- [ ] Configure rate limits (defaults are sensible but review for your use case)
|
||
|
|
- [ ] Run regular backups via the admin panel
|
||
|
|
- [ ] Keep the server updated (admin panel shows available updates)
|
||
|
|
- [ ] Firewall: only expose port 8443 (HTTPS) and 7880 (LiveKit WebSocket for voice/video)
|
||
|
|
- [ ] Enable server-wide 2FA requirement once all users have enrolled
|
||
|
|
- [ ] Set `admin_allowed_cidrs` to restrict admin panel access to trusted networks
|