sillyspace/SECURITY.md

Security Policy

Bliish.space deployments are operator-managed instances.

Reporting Vulnerabilities

Report sensitive issues through the repository's private vulnerability reporting channel if one is configured. If not, contact the maintainer privately before publishing details.

For non-sensitive issues, open a public issue with:

• affected version or commit;
• affected route or feature;
• expected behavior;
• actual behavior;
• reproduction steps;
• impact assessment.

Supported Versions

Security fixes target the current main branch unless a release branch states otherwise.

Security Boundaries

Bliish.space currently treats these areas as security-critical:

• password hashing;
• cookie sessions;
• CSRF checks;
• profile HTML and skin sanitization;
• upload validation and normalization;
• oversized request rejection;
• form action rate limiting;
• security headers;
• account export and deletion;
• role-based admin and moderator actions;
• report moderation;
• post, comment, and upload deletion paths;
• private profile visibility.

Non-Goals

Bliish.space does not provide:

• hosted abuse monitoring;
• centralized moderation;
• managed backups;
• managed email reputation;
• DDoS protection;
• security guarantees for modified custom skins or reverse proxy configs.

Instance operators are responsible for host hardening, TLS, backups, logs, and abuse response.