Skip to content

SECURITY.md

Latest commit

 

History

History
156 lines (106 loc) · 5.91 KB

SECURITY.md

File metadata and controls

156 lines (106 loc) · 5.91 KB
Raw

Security Policy - TaskBoard

Version License Framework Database

📋 Table of Contents

🛡️ Supported Versions

Version Supported
4.x ✅ Active
< 4.0 ❌ End of Life

Only the latest minor release receives security updates. Ensure you are on the most recent version before reporting.

🚨 Reporting a Vulnerability

If you discover a security vulnerability in TaskBoard, please report it responsibly and privately. Do not open a public issue.

Preferred method:

Alternative method:

What to include:

Field Details
Description Clear explanation of the vulnerability
Reproduction Steps to reproduce - minimal PoC if possible
Component Affected file / module and version
Impact Privilege escalation, data exposure, etc.
Fix Suggested mitigation (optional)

Response timeline:

Phase Timeframe
Initial acknowledgment Within 48 hours of receipt
Status update Within 5 business days
Resolution Within 30 days (critical issues)
Public disclosure Coordinated after fix is released

📢 Disclosure Policy

We follow a coordinated disclosure model:

  1. Report received and acknowledged
  2. Vulnerability validated and severity assessed
  3. Fix developed and tested
  4. Security release published to all supported versions
  5. Public disclosure with credit to reporter (if desired)

No premature disclosure. Do not open public issues or pull requests for security bugs until the fix is released.

🔍 Security Considerations

Scope

TaskBoard is a self-hosted Next.js application with an embedded SQLite database. It:

  • Authenticates users with bcrypt-hashed passwords and HMAC-signed session cookies
  • Enforces role-based access (leader / member / client) server-side on every API route
  • Stores task attachment images under public/images/
  • Persists all data in data/taskboard.db

Known Risk Areas

Area Risk Mitigation
Session signing Forgery if SESSION_SECRET leaks HMAC-SHA256 signed httpOnly cookies; secret required at boot; sessions invalidated on password change
Password storage Credential theft bcrypt hashing with salt rounds; passwords never returned by the API
File uploads Malicious payloads / path traversal Upload restricted to leader/client roles, UUID-based naming, path sanitization
Role enforcement Privilege escalation Every API route checks the caller's role server-side; assigneePrices redacted for non-leaders
SQLite file Local data exposure Keep data/ outside the web root access of any reverse proxy; filesystem permissions
Dependencies Supply chain npm audit + CI pipeline; Dependabot-style updates recommended

Recommendations

  1. Use a long, random SESSION_SECRET - the app refuses to boot without it:

    openssl rand -hex 64

  2. Serve behind HTTPS - run behind a reverse proxy (nginx, Caddy, etc.) so session cookies transit encrypted.

  3. Protect data/ and .env.local - never expose them publicly; restrict filesystem permissions.

  4. Keep Node.js updated - run on a supported LTS release (>= 20).

  5. Back up data/taskboard.db - the database is a single file; include it in your backup routine.

🔒 Security Measures

TaskBoard implements several security measures out of the box:

  • Session Management - HMAC-SHA256 signed httpOnly cookies with 7-day expiry
  • Password Hashing - bcrypt with salt rounds
  • Rate Limiting - Per-IP rate limiting on authentication endpoints
  • Input Validation - Zod schemas on all API routes
  • XSS Protection - DOMPurify sanitization on user-generated content
  • Security Headers - X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

🏆 Hall of Fame

We thank the following security researchers for responsible disclosure:

(None yet - be the first!)

Built by Shadow-x78 · RED SHADOWS | RS · Back to README

© 2026 TaskBoard