Privacy and Security

Privacy and Security

This page lists everything Waymark shows to anyone who can reach it, and how to keep it private. Back to the README.

There is no login

There is no login. Anyone who can reach the page sees everything it shows. The JSON API (/api/site.json, /api/p/..., /api/search.json, /api/live.json), the live stream (/events) and /healthz serve the same data. All of it:

What	What anyone can see
Repos	Names and links (which show your forge's address); descriptions, default branches, stars, open issue and PR counts, archived and mirror flags, tags and their dates. Private repos only when you turn them on (include_private: true); they are off by default.
Issues and PRs	Titles, numbers, labels and their colours, authors, comment counts and dates (up to 10 open issues and 10 open PRs per project, and 10 of its mirror's issues), and the titles of those that wait on you.
Commits	The first line of each recent commit message, its author name, SHA and date; weekly commit counts; a year of daily contribution counts of the token users (the heatmap), which count all their activity, private repos included whatever include_private says (numbers only, no repo names).
CI	Run titles, branches, workflow names, state and times.
Releases	Tag names and release titles (not release notes), with dates.
Files read from repos	The CHANGELOG.md Unreleased items and last version; plan file paths, titles and checkbox progress.
The projects file	Every project's name, summary, description, stack, "runs on" text, categories, holds and their reasons, relations, links, and each urls: link and probe URL, which can name internal hosts.
Probes	Each URL's state, HTTP code, latency and 24-hour history, and each repo homepage probed.
Docker, when set up	Container names, image names (with their registry), versions, states and Docker's status text, and the host label.
F-Droid, when set up	The published version.
Notes, when set up	File names, names, descriptions, index lines and each markdown note's text.
Ideas	Titles, pitches, reasons, and links to issues.
Events	Events for 14 days (releases, deploys, containers, CI, commits, issues, probes, notes and state changes).
Source errors	Source errors, which can name file paths, hosts and the repos the projects file names.

Anyone can ask for a refresh

Anyone who can reach it can also ask for a refresh (at most one every 20 seconds), which only reads again (on GitHub, only what changed).

POST /api/refresh refuses a request that another site makes the browser send (Sec-Fetch-Site of cross-site or same-site).

Keep it private

Put it behind a reverse proxy that asks for a login (basic auth, or an OAuth or forward-auth proxy), or keep it on your LAN or VPN. Publish the port on loopback (-p 127.0.0.1:8080:8080) unless something in front of it guards it.

Private repos

Private repos are left out by default (include_private: false): from projects, needs-you, ideas, events, the ship log and the map.

A repo shows only once it is known to be public, so while a forge has not answered, a project or mirror from the projects file whose privacy is unknown stays hidden.

To show private repos, set include_private: true (or WAYMARK_INCLUDE_PRIVATE=true without a file): then everything above shows for them too, to anyone who can reach the page, so only behind a login.

A GitHub forge without a token cannot tell that a repo the projects file names is private (GitHub answers 404 to anonymous reads), so such a project shows only what the projects file says about it, and a mirror it names on that forge is linked as named.

More detail: include_private.

Tokens

Tokens need only read access (see the scopes), and are never shown: not in pages, logs, errors or /api/site.json. Every forge call is a read.

Homepage probes

Homepage probes (each repo's website field, probes.homepages) refuse loopback, private (RFC 1918, IPv6 ULA), link-local, CGNAT (100.64.0.0/10), unspecified (0.0.0.0/8, ::) and multicast addresses (IPv4, IPv6 or IPv4-mapped), checked after DNS, and do not use HTTP_PROXY or HTTPS_PROXY: anyone who can edit a repo can set its website. The projects file's urls: are yours, and are probed as given.

Homepage probes do not refuse NAT64, benchmarking or other reserved ranges; they report only up or down and the latency.

More detail: probes.

In the visitor's browser

• One cookie: when a visitor picks a theme, the page sets one cookie, theme (for one year), so the server renders the theme the visitor chose. The page also keeps theme, lastVisit and lastVisitBaseline in the visitor's localStorage.
• Nothing from other sites: every response carries a Content-Security-Policy that lets the page load only from Waymark itself, so it loads nothing from other sites. Waymark serves its own fonts.