mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00

Files

T

jevb cec6ca6a97 docs: add public documentation for contributors and users

Created 12 public docs derived from internal vault:
- Setup guides: quick-start, server-configuration, livekit-setup, deployment
- Networking: port-forwarding, tailscale
- References: api, protocol, schema, client-architecture
- Community: contributing, security

Updated .gitignore to only exclude docs/brain/ (internal vault),
allowing docs/ to be tracked. Updated README with expanded quick
start, voice/video setup, networking ports, and doc links.

2026-03-30 22:31:06 +02:00

1.6 KiB

Raw Blame History

Security Policy

Security guidelines and vulnerability reporting for OwnCord.

Reporting Vulnerabilities

Use GitHub Security Advisories to report vulnerabilities: go to Settings > Security > Advisories and create a new advisory.

Do NOT open public issues for security bugs.

Response Timeline

Acknowledgment: Within 48 hours
Critical fixes: Within 7 days
Non-critical fixes: Included in the next release

Two-Factor Authentication

OwnCord supports TOTP-based 2FA:

Users enroll via Settings > Account (QR code + backup codes)
Admins can enforce server-wide 2FA via the require_2fa setting in the admin panel
require_2fa requires all users to have 2FA enabled and registration to be closed
Login flow returns requires_2fa: true with a partial_token (10-min TTL, 5-attempt limit)
Auth challenges are rate-limited to 10 req/min per IP

Known Limitations

No code signing yet -- binaries are verified via SHA256 checksums only

Security Hardening Checklist for Operators

Enable TLS (self-signed is the default; custom certs recommended for production)
Keep invite-only registration enabled (default)
Set a strong admin password
Configure rate limits (defaults are sensible but review for your use case)
Run regular backups via the admin panel
Keep the server updated (admin panel shows available updates)
Firewall: only expose port 8443 (HTTPS) and 7880 (LiveKit WebSocket for voice/video)
Enable server-wide 2FA requirement once all users have enrolled
Set admin_allowed_cidrs to restrict admin panel access to trusted networks

1.6 KiB Raw Blame History