Skip to content

Repository navigation

Security: wscale2026/visimags

Security

docs/SECURITY.md

Security Policy

Reporting a vulnerability

Please do not open a public issue for security problems.

Email the maintainer privately (see the project author contact on the GitHub profile) with:

  • a description of the issue;
  • affected versions/components;
  • reproduction steps (if available).

You should receive a response within a few days.

Secrets handling

  • Production secrets (Django SECRET_KEY, DATABASE_URL, SMTP credentials, ENCRYPTION_KEY) are read from environment variables via django-environ and are never committed.
  • Committed examples use placeholders (backend/.env.example, backend/.env.production.example, frontend/.env.production.example).
  • If a real credential is ever pushed to Git, rotate/revoke it immediately and remove it from the Git history.

Authentication

  • Short-lived JWT access tokens (60 min).
  • Rotating refresh tokens stored in an httpOnly, Secure cookie scoped to /api/auth/.
  • Production cookie settings: AUTH_REFRESH_COOKIE_SECURE=True, SESSION_COOKIE_SECURE=True, CSRF_COOKIE_SECURE=True.

Production hardening

  • DEBUG=False, SECURE_SSL_REDIRECT=True, HSTS enabled.
  • SECURE_CONTENT_TYPE_NOSNIFF=True, SECURE_REFERRER_POLICY=same-origin, X_FRAME_OPTIONS=DENY.
  • CORS/CSRF allowed origins restricted to the app subdomain.
  • Sensitive fields encrypted with AES (ENCRYPTION_KEY).

Tenant data

Tenant export bundles (deployment/lws/data/*) contain real production data (users, contacts, visit photos). They must never be committed to a public repository; they are git-ignored.

There aren't any published security advisories