Security

Security

Canonical reference in the repository: SECURITY.md.

Reporting a vulnerability

Do not open a public issue for a security problem. Contact the repository maintainer privately (GitHub Security Advisories or direct message).

Deployment best practices

• Set AUTH_SECRET to a strong value (openssl rand -hex 32; 32 characters minimum).
• Never commit .env or data/hobbyhoops.db (or WAL files).
• For plain HTTP (no reverse proxy): COOKIE_SECURE=false, TRUST_PROXY=false — see the README.
• For production HTTPS: expose the app behind a reverse proxy; leave COOKIE_SECURE at its default or force true; enable TRUST_PROXY=true only if the proxy rewrites X-Forwarded-For / X-Forwarded-Proto.
• Set BOOTSTRAP_TOKEN (required in production) and send the X-Bootstrap-Token header to create the first account, then remove or rotate the token after bootstrap.
• Restrict network access to the container (port bound to 127.0.0.1 in docker-compose.yml).
• Back up data/hobbyhoops.db regularly — see Data-and-backup.

Access model

Unauthenticated visitors see the login form at /. Every authenticated user can access /admin and write APIs (personal / family instance model).

Sessions

• Session cookie: httpOnly, Secure (production / HTTPS), SameSite=strict
• CSRF / Fetch Metadata checks on auth and mutating APIs
• Rate limiting on login, bootstrap, and write endpoints

Full detail: SECURITY.md.