26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# Security Policy
|
|
|
|
TinyWeb is a self-hosted personal search engine with no authentication. It is
|
|
bound to localhost by default. Do not expose it to the internet without a
|
|
reverse proxy with authentication.
|
|
|
|
## Supported Versions
|
|
|
|
Security fixes are handled on the default branch.
|
|
|
|
## Deployment Guidance
|
|
|
|
- Keep TinyWeb bound to `127.0.0.1` unless you need LAN access
|
|
- If binding to `0.0.0.0`, put a reverse proxy with auth in front (Caddy, nginx)
|
|
- Always use HTTPS when exposing beyond localhost
|
|
- Protect `~/.tinyweb/tinyweb_identity` — losing it changes your destination hash
|
|
- Protect `~/.tinyweb/index.db` — contains your full browsing history
|
|
- Never commit `*.db`, `tinyweb_identity`, `.env`, or `models/` to version control
|
|
- Keep `--bind 0.0.0.0` usage to trusted networks only
|
|
- The bookmarklet token is sent as a plain URL parameter — treat it as a secret
|
|
- Forum plugin: moderation is gossip-based; block lists can be manipulated
|
|
|
|
## Reporting
|
|
|
|
Report vulnerabilities privately by creating a confidential issue on the
|
|
repository. Do not file a public issue until the report has been acknowledged.
|