From 00f9286eb822d0520f7c33146934006930dfce8c Mon Sep 17 00:00:00 2001 From: blankie Date: Thu, 2 Jul 2026 23:32:58 +0000 Subject: [PATCH] security: replace personal email with confidential issue reporting --- SECURITY.md | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index f294f81..7001dbf 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1 +1,26 @@ -If you find a security issue, report it privately by emailing blankie@tuta.com. Please don't file a public issue. +# Security Policy + +TinyWeb is a self-hosted personal search engine with no authentication. It is +bound to localhost by default. Do not expose it to the internet without a +reverse proxy with authentication. + +## Supported Versions + +Security fixes are handled on the default branch. + +## Deployment Guidance + +- Keep TinyWeb bound to `127.0.0.1` unless you need LAN access +- If binding to `0.0.0.0`, put a reverse proxy with auth in front (Caddy, nginx) +- Always use HTTPS when exposing beyond localhost +- Protect `~/.tinyweb/tinyweb_identity` — losing it changes your destination hash +- Protect `~/.tinyweb/index.db` — contains your full browsing history +- Never commit `*.db`, `tinyweb_identity`, `.env`, or `models/` to version control +- Keep `--bind 0.0.0.0` usage to trusted networks only +- The bookmarklet token is sent as a plain URL parameter — treat it as a secret +- Forum plugin: moderation is gossip-based; block lists can be manipulated + +## Reporting + +Report vulnerabilities privately by creating a confidential issue on the +repository. Do not file a public issue until the report has been acknowledged.