Skip to content

Security

Jump to bottom
mcinquin edited this page Oct 12, 2026 · 1 revision

Security

Canonical reference in the repository: SECURITY.md.

Reporting a vulnerability

Do not open a public issue for a security problem. Contact the repository maintainer privately (GitHub Security Advisories or direct message).

Deployment best practices

  • Set NEXTAUTH_SECRET to a strong value (openssl rand -base64 32).
  • Never commit .env.
  • For plain HTTP (no reverse proxy): NEXTAUTH_URL=http://127.0.0.1:3000 — see the README.
  • For production HTTPS: terminate TLS on Apache (apache/markit.conf); keep the app on 127.0.0.1 only; set NEXTAUTH_URL to the public https:// URL.
  • Restrict database access (Compose exposes no Postgres port).
  • Back up PostgreSQL regularly — see Data-and-backup.

Access model

Unauthenticated visitors use sign-in / sign-up. Authenticated users access their teams and boards. Admin routes are restricted to admin accounts. API and Socket.io paths check session and team membership.

Sessions

  • NextAuth JWT sessions signed with NEXTAUTH_SECRET
  • Secure cookies when served over HTTPS
  • Socket.io authenticates with the same JWT server-side

Full detail: SECURITY.md.

Clone this wiki locally