tinyweb/SECURITY.md

Security Policy

TinyWeb is a self-hosted personal search engine with no authentication. It is bound to localhost by default. Do not expose it to the internet without a reverse proxy with authentication.

Supported Versions

Security fixes are handled on the default branch.

Deployment Guidance

• Keep TinyWeb bound to 127.0.0.1 unless you need LAN access
• If binding to 0.0.0.0, put a reverse proxy with auth in front (Caddy, nginx)
• Always use HTTPS when exposing beyond localhost
• Protect ~/.tinyweb/tinyweb_identity — losing it changes your destination hash
• Protect ~/.tinyweb/index.db — contains your full browsing history
• Never commit *.db, tinyweb_identity, .env, or models/ to version control
• Keep --bind 0.0.0.0 usage to trusted networks only
• The bookmarklet token is sent as a plain URL parameter — treat it as a secret
• Forum plugin: moderation is gossip-based; block lists can be manipulated

Reporting

Report vulnerabilities privately by creating a confidential issue on the repository. Do not file a public issue until the report has been acknowledged.