跳到內容
Surfski

Security

本頁內容尚未翻譯。

  • The container publishes only on 127.0.0.1, runs as non-root uid 10001 with a read-only root filesystem, cap_drop: ALL and no-new-privileges, and uses its own network.
  • Docker-published ports bypass host firewalls like ufw. Rely on your cloud firewall or security group: open 80/443 only.
  • Every accounts query is scoped to the caller. Refresh tokens are Fernet-encrypted at rest. Access tokens live only in memory.
  • Logs never contain tokens, auth codes or message bodies. Audit rows record the tool, alias and a short detail only.
  • See SECURITY.md to report a vulnerability.

Synced from rayhu/surfski/README.md@e4c5de0. The repository is the source of truth.