mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
Tomas DvorakandDevin
9f3b196032
Backend: - GET /services/:id/metrics with real Docker container stats - DELETE /git/providers/:id and GET repo branches endpoint Frontend: - Service detail shows real telemetry or honest empty states - Live status distinguishes idle/polling/reconnecting - Git providers section in Settings; repo+branch pickers in Add Service - Real logo, compact Projects header, canvas fitView fix - index.css deduplicated (1725 -> 1384 lines) - Fixed smoke tests, lint errors, ToastProvider/context unification Repo hygiene: - Added LICENSE (MIT), CONTRIBUTING.md, SECURITY.md; rewrote README - Untracked .env.prod and data/letsencrypt secrets; fixed .gitignore - Removed legacy root src/internal/cmd and stale configs/docs/artifacts - Moved guides and design references under docs/ Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
46 lines
1.5 KiB
Markdown
46 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please do **not** open a public issue for security vulnerabilities.
|
|
|
|
Report privately via GitHub's private vulnerability reporting
|
|
(Security tab → Report a vulnerability), or contact the maintainer directly.
|
|
|
|
Include:
|
|
|
|
- A description of the vulnerability and its impact
|
|
- Steps to reproduce
|
|
- Affected version/commit if known
|
|
|
|
You will receive an acknowledgement as soon as possible. Please allow
|
|
reasonable time for a fix before any public disclosure.
|
|
|
|
## Scope
|
|
|
|
Containr is a self-hosted platform that runs Docker containers, stores
|
|
credentials, and terminates user traffic. In scope:
|
|
|
|
- Authentication and session handling (Better Auth sidecar, JWT, agent tokens)
|
|
- Secrets storage (Git provider tokens, environment variables)
|
|
- API authorization and per-user resource scoping
|
|
- Webhook signature validation
|
|
- CORS and trusted-origin configuration
|
|
- Deployment engine command/path handling
|
|
|
|
## Secrets
|
|
|
|
- Never commit `.env`, `.env.prod`, or any file containing credentials.
|
|
- Git provider access tokens are stored server-side only and are never
|
|
returned by the API.
|
|
- Rotate any secret that has ever been committed to git history.
|
|
|
|
## Self-Hosting Notes
|
|
|
|
- Set strong `JWT_SECRET`, `BETTER_AUTH_SECRET`, and
|
|
`BETTER_AUTH_INTERNAL_TOKEN` values in production.
|
|
- Set `COOKIE_SECURE=true` when serving over HTTPS.
|
|
- Restrict `CORS_ALLOWED_ORIGINS` to your actual frontend origin.
|
|
- Keep Traefik's dashboard disabled or behind auth in production
|
|
(`TRAEFIK_API_INSECURE=false`).
|