cesnimda
1.9 KiB
1.9 KiB
Security assessment policy context for Jobjakt (template; merge with existing SECURITY.md instead of overwriting)
Expected security invariants
- Every private CV, job application, profile, generated file, upload, analytics item, AI job and billing record is accessible only by its authorized owner or explicitly permitted administrative role.
- Authorization is enforced server-side on every operation and object, including background jobs, exports, previews, nested references and bulk actions. Never rely solely on client-side role guards.
- Identity verification, session revocation, TOTP, password recovery and OAuth flows cannot be used to gain another identity without authorization.
- Untrusted CV/document/AI text cannot execute instructions, force network access, leak secrets or modify records outside authenticated user's permissions.
- Uploaded documents and PDF renderers are isolated from internal networks, container host paths, real credentials and other users' files.
- Production signing secrets, DB credentials, OAuth tokens and user CV contents are never committed, embedded in frontend bundles or logged.
- Live MariaDB/Ollama/internal services are not public attack surfaces without an expressly designed secure gateway.
Evidence policy
Require sanitized reproductions against test fixtures, source locations, expected vs actual, and test results. Findings without execution are LIKELY or UNVERIFIED, not CONFIRMED. Sensitive evidence belongs outside source control.
Priority criteria
Treat confirmed cross-user CV access, account takeover, active secret disclosure, privilege escalation and remote code execution as potential release blockers. Assign severity from actual reachability, impact and conditions, not scanner scores alone.
Engagement boundaries
No penetration testing of production, other peoples' data, external OAuth/payment providers, or unrelated home-server services; staging network attacks require exact separate authorization.