23 lines
1.2 KiB
Markdown
23 lines
1.2 KiB
Markdown
# Security model
|
|
|
|
- SQL statements use bound parameters.
|
|
- Short codes are restricted to ASCII alphanumerics.
|
|
- URL, retention, code, and request-body sizes are bounded.
|
|
- API-key comparison is constant-time. Protected operations return no body on
|
|
authentication failure.
|
|
- Per-IP sliding-window throttling applies to API calls and redirects. Embedded
|
|
frontend files do not consume API quota.
|
|
- Client identity uses `X-Real-IP`, then the first `X-Forwarded-For` value,
|
|
then the TCP peer. Bind the container port to loopback and let only a trusted
|
|
reverse proxy overwrite those headers.
|
|
- CORS preflight uses `OPTIONS` and does not consume rate-limit quota.
|
|
- The runtime Compose definitions use a read-only root filesystem, drop Linux
|
|
capabilities, enable `no-new-privileges`, and run as a numeric non-root user.
|
|
- The runtime image contains no shell, package manager, Python runtime, or
|
|
external static files.
|
|
- `SIGINT` and `SIGTERM` cleanly unblock the server for prompt shutdown.
|
|
|
|
Keep `api_key` out of Git, image layers, command output, and monitoring labels.
|
|
The supplied nginx configurations forward trusted proxy headers and keep the
|
|
application port bound to `127.0.0.1`.
|