Security

Reporting a vulnerability

If you find a security problem in Apsi, in a library on the registry, or in this website, please tell us privately:

use the report form and choose Security vulnerability, or
contact [email protected].

Please include what is affected, how to reproduce it, and what an attacker could do. Give us reasonable time — normally up to 90 days — to fix the problem before you tell others. Do not access other people’s data, disrupt the service, or use automated scanners that put load on the site. We will not take action against good-faith research that follows these rules, and we credit reporters who want to be credited.

A machine-readable contact is published at /.well-known/security.txt.

How this website protects you

Encryption everywhere: HTTPS only (TLS 1.2+, HSTS with preload; .dev addresses cannot be opened without HTTPS). In the database, e-mail addresses, Google account ids, two-factor secrets and private report addresses are encrypted with AES-256-GCM; members are looked up through a keyed HMAC, never through the plain address.
Passwords are hashed with scrypt at the strength OWASP recommends (128 MiB, N = 2^17) and a unique salt. Unknown accounts and wrong passwords take the same time to check, and repeated failures lock the account temporarily.
Two-factor authentication with any standard authenticator app (TOTP). Each code works only once.
Sessions end after 14 days without use and are limited to 20 devices per account. They are random 256-bit tokens stored only as hashes, in cookies marked HttpOnly, Secure and SameSite. Every form is protected against cross-site request forgery.
API tokens are shown once, stored only as hashes, can be limited to one library and to specific permissions, expire, and can be revoked at any time.
Strict browser policies: a Content Security Policy that allows only this site’s own scripts, HSTS, no framing, no MIME sniffing, and a restrictive permissions policy.
User content is rendered from Markdown with raw HTML disabled; links to other sites are marked nofollow ugc. Uploaded files are identified by their content, not their name; only images and videos are accepted for posts, and they are served from a sandboxed path.
Protection at the edge: the site runs behind Cloudflare, with no ports open on the server, and answers only to its own address.
Rate limits on sign-in, sign-up, posting, reports, uploads and the API.
No third-party scripts, trackers or external fonts.

How Apsi protects you

Programs run with explicit permissions for files, network, environment and native libraries (--allow-read, --allow-net, …).
Apsi Guard scans programs before they run and libraries when they are installed, and blocks critical findings.
Libraries are verified end to end: the registry’s SHA-256 of the whole file, the SHA-256 of every file in the manifest, and no paths outside the package folder.
The native compiler’s machine-code cache is signed, so tampered cache files are rejected.

See the security guide for details.