ushort/docs/security.md

Security model

• SQL statements use bound parameters.
• Short codes are restricted to ASCII alphanumerics.
• URL, retention, code, and request-body sizes are bounded.
• API-key comparison is constant-time. Protected operations return no body on authentication failure.
• Per-IP sliding-window throttling applies to API calls and redirects. Embedded frontend files do not consume API quota.
• Client identity uses X-Real-IP, then the first X-Forwarded-For value, then the TCP peer. Bind the container port to loopback and let only a trusted reverse proxy overwrite those headers.
• CORS preflight uses OPTIONS and does not consume rate-limit quota.
• The runtime Compose definitions use a read-only root filesystem, drop Linux capabilities, enable no-new-privileges, and run as a numeric non-root user.
• The runtime image contains no shell, package manager, Python runtime, or external static files.
• SIGINT and SIGTERM cleanly unblock the server for prompt shutdown.

Keep api_key out of Git, image layers, command output, and monitoring labels. The supplied nginx configurations forward trusted proxy headers and keep the application port bound to 127.0.0.1.