Files

T

Moheeb Zara 8ad1ca44b7 feat: open-source release prep, audit fixes, and deploy hardening

Production deploy completed (DigitalOcean Droplet, self-hosted Supabase,
Caddy + Let's Encrypt, GitHub Actions auto-deploy on push to main, daily
pg_dumpall backups). This commit lands the work that came out of the
deep audit pass and the open-source release prep.

Audit fixes:
- Webhook signing secret is now displayed in the settings UI with
  show/hide and copy-to-clipboard; the broken external docs.hackerspace.sh
  link is replaced with a link to the new local docs.
- Settings updateSpaceSettings parameter type now includes
  mission_statement so the field persists.
- members page enforces member_directory_visibility for non-admin viewers
  (admin_only, board_visible, members_visible).
- Mobile responsiveness pass: Projects Kanban grid, Members + Payments
  tables (column hiding on small screens), Proposal tally + voting
  buttons (2-col on mobile).

Open-source release scaffolding:
- LICENSE (MIT).
- CONTRIBUTING.md with dev setup, conventions, PR flow.
- SECURITY.md with disclosure policy.
- CHANGELOG.md.
- docs/WEBHOOKS.md with Node and Python signature verification examples.
- README.md rewritten for an open-source audience.

Removed v0/Vercel references:
- @vercel/analytics dependency removed.
- app/layout.tsx no longer imports Analytics, drops generator: 'v0.app'.
- Canonical deployment docs (docs/DEPLOYMENT.md, docs/README.md,
  docs/ARCHITECTURE.md, DATABASE.md, CLAUDE.md, README.md) now describe
  the self-hosted Droplet target only.
- e2e console-error check no longer filters [v0] noise.

Landing page:
- GitHub icon link to the public repo in the nav and footer.

2026-05-14 16:28:16 -07:00

1.9 KiB

Raw Permalink Blame History

Security Policy

Reporting a vulnerability

Please do not report security vulnerabilities in public GitHub issues, discussions, or pull requests.

Instead, email a description of the issue, reproduction steps, and any proof-of-concept code or screenshots to security@hackerspace.sh. We will acknowledge receipt within three business days and provide a remediation timeline within seven business days.

If you do not receive a timely response, you may also open a private GitHub Security Advisory at https://github.com/virgilvox/hackerspace-management/security/advisories/new.

Scope

In scope:

Authentication and authorization bypass
Tenant isolation failures (cross-space data leaks)
SQL injection, XSS, CSRF, SSRF
Secret exposure or weak secret storage
Insecure default configurations in the deploy scripts

Out of scope:

Self-XSS that requires user-supplied JavaScript pasted into the browser console
Issues only reproducible against unsupported runtime versions
Denial of service achievable by a single authenticated user (rate limiting is a known follow-up; see the audit doc)

Hardening checklist for self-hosted operators

If you run a self-hosted deployment, you are responsible for the operational security of your installation. At a minimum:

Keep the host OS patched. The bootstrap installs unattended-upgrades.
Restrict SSH to key-based auth. Root login is disabled by the bootstrap.
Run a firewall. The bootstrap configures UFW with ports 22, 80, 443 only.
Rotate the Supabase service role key and JWT secret if your .env is ever exposed.
Monitor the _migrations_applied table after deploys.
Verify backups by restoring to a staging instance at least quarterly.
Use Resend (or another SMTP provider) over plain SMTP with credentials in environment variables, never embedded in code.

Supported versions

The main branch is the supported version. Older tags receive security fixes on a best-effort basis only.