Security
Report it privately.
Security problems go to us in private, not into a public issue. This is what you can expect.
Report a vulnerability privately
Report a vulnerability privately, not in a public issue or discussion. Write to security@refiroo.org, or use GitHub's private vulnerability reporting on the repository.
Say what you found, the version (Settings › About shows it) and how to reproduce it. A proof of concept helps. Please do not touch data that is not yours.
refiroo is maintained by one person. You will get an acknowledgement within 7 days as a best effort. There is no round-the-clock promise.
We work with you on a fix and agree a disclosure date before anything is published. You are credited in the advisory and the changelog unless you prefer not to be.
Which versions get fixes
Before 1.0, only the latest minor release receives security fixes. A fix is a new tagged release, and its tag is the corresponding source.
What is in scope
The engine, the browser application, the container images and the reference installation in Compose, as the operations guide describes it.
Out of scope: findings that need an already-compromised host or administrator account, missing hardening of a deployment that does not follow the operations guide, and denial of service by sheer volume.
Who can do what
- Every API needs a signed-in person or an access token the engine issues (OAuth 2.0, JWT). There are no API keys, and no credential appears in a URL.
- What a caller may do is decided by its roles, which are sets of action groups, granted to people, groups and clients at the instance or in a workspace.
- Every change records who made it.
- A local account can add a second factor: an authenticator app, with ten recovery codes shown once. A person can also sign in with the organisation's provider.
- Webhooks are signed with an HMAC key per subscription, generated by the engine and shown once. Keys can be rotated.
AI only where you switch it on
Nothing is sent anywhere unless an operator configures a provider, and nothing writes live data without a person.
An assistant with agent access works within what the person or client may do, only in change sets it created, and can never approve, publish, remove or clear anything.
The 0.12 review
The 0.12 security review and its findings are in the repository: docs/SECURITY_REVIEW_0_12.md at v0.16.0.
Let us run it for you.
Backups, upgrades, TLS and monitoring are ours. Your data stays exportable any time.