Reporting a vulnerability #

Please report vulnerabilities privately through GitHub's Report a vulnerability button (Security tab of this repository). Don't open a public issue. You'll get an answer within 7 days; fixes are released as soon as they're ready and credited if you want.

What ArtScript apps get by default #

• Passwords: scrypt hashes, never returned by the api; minimum 8 characters.
• Sessions: random tokens in HttpOnly; SameSite=Lax cookies, 30 days, expired on the server too; auth.logoutAll(); a new password ends the user's other sessions.
• Rate limit: 600 api requests per address per minute (ART_RATE_LIMIT), then 429.
• Login: 10 failed attempts per email and address in 15 minutes, then 429.
• Password reset and email verification: single-use links valid for one hour, stored as SHA-256 hashes; a reset request answers the same whether the account exists or not (5 per email per hour), and a reset ends every session of the account. New accounts are always unverified.
• Sign-in with Google/GitHub: the flow carries a random state checked against an HttpOnly cookie; only provider-verified emails are accepted.
• CSRF: writes must be JSON and uploads must carry x-file-name, which a cross-site page can't send without a CORS preflight (never answered).
• Access control: login, private (rows scoped to their owner) and admin apis; relations can only point to rows the writer can see.
• Validation: every write is checked against the model and its field rules on the server.
• Limits: JSON bodies up to 1 MB (ART_MAX_JSON), uploads up to 10 MB (ART_MAX_UPLOAD).
• Uploads: name, type and size come from the server's record; anything but images, video, audio, PDF and plain text is served as a download, always with nosniff and a sandbox CSP.
• XSS: text is set with textContent; javascript:, vbscript: and data:text/html URLs from data become #.
• Headers (art build server): CSP (script-src 'self', ART_CSP to change it or off), X-Frame-Options: DENY, nosniff, Referrer-Policy, and HSTS behind an HTTPS proxy (X-Forwarded-Proto: https).
• Static files: the data directory, the server code and dotfiles are never served.

Known limits #

• Rate limits and live streams are per process; behind several processes, use a shared limiter at the proxy.
• No CORS: the api is meant to be served from the app's own origin.