Security
Security baseline
Project standards for authentication, authorization, untrusted input, and operational secrets.
Authentication and authorization
- Apply OAuth 2.0 + PKCE and hierarchical Mastodon scopes to every protected endpoint.
- Store access tokens as SHA-256 hashes, never plaintext.
- Support TOTP and WebAuthn/passkeys, and strongly recommend them for administrators.
- Recheck suspended accounts, object ownership, administrator privileges, and registration mode on the server.
- Apply CSP, X-Content-Type-Options, and anti-framing headers to browser and API responses.
Trust boundaries
| Input | Required defense |
|---|---|
| Federated HTML | Allowlist sanitization and removal of dangerous URLs and attributes |
| Remote URLs | SSRF defense plus IP, protocol, redirect, size, and timeout limits |
| Media | MIME and size validation, asynchronous processing, and safe Content-Disposition |
| OAuth requests | Exact redirect URI matching plus PKCE, scope, and state validation |
| ActivityPub | Signature, Digest, actor, domain, and audience validation |
Vulnerability reporting
!
Do not post sensitive reproduction details in public issues
Report vulnerabilities that require coordinated disclosure privately to the repository owner. Remove real tokens, user data, and details about instances under active attack.
- Affected versions and configuration
- Minimal reproduction steps and expected versus actual results
- Impact on permissions, visibility, and federation
- Logs or a proof of concept with secrets removed
- A secure channel for contacting the reporter
Want to improve this documentation?Every contribution helps.
Contribute on GitHub ↗