27 lines
1.0 KiB
Markdown
27 lines
1.0 KiB
Markdown
# Security and dependency notes
|
|
|
|
Version 0.0.1 is distributed as source and uses the dependency versions pinned in `Cargo.lock`.
|
|
|
|
Key controls include:
|
|
|
|
- Argon2id for new passwords while retaining verification of imported PBKDF2 hashes;
|
|
- HS256 JWT validation with bounded expiry;
|
|
- request body size/deadline limits and login throttling;
|
|
- escaped UI output and restrictive response security headers;
|
|
- redaction of configured secrets from device-operation errors;
|
|
- SSH host-key verification with `accept-new` or `strict` policy;
|
|
- private data/storage permissions and a single-writer storage lock;
|
|
- non-root Alpine container runtime with dropped Linux capabilities and a read-only root filesystem;
|
|
- local Swagger UI without CDN dependencies.
|
|
|
|
The project patches `libssh2-sys` locally for audited upstream fixes. Provenance is documented in `vendor/libssh2-sys/PROVENANCE.md`.
|
|
|
|
The retained advisory scan artifacts are:
|
|
|
|
```text
|
|
docs/dependency-audit.json
|
|
docs/dependency-audit-metadata.json
|
|
```
|
|
|
|
Third-party license text is in `docs/THIRD_PARTY_NOTICES.txt`.
|