Warn that path-hosted sites share browser storage and credentials and are suitable only for mutually trusted content until per-site origins exist.
- commit
- 84f958a8a9fdc85c1da5e723169e1f505110a294
- parent
- 76f1c02f8db5532398510674cdaa46abbfe98b3d
- author
- Dami <dami.etoile@gmail.com>
| M | SECURITY.md | 10 | ++++++++++ |
@@ -4,6 +4,13 @@ nzip is a personal, single-owner service. Its short public URLs are convenient a
44 secrets. Security comes from explicit authentication, password protection where needed, bounded55 public surfaces, owner-approved device enrollment, and observable abuse controls.66 7+Only publish content you trust. Sites hosted at `https://<deployment>/<address>/` share one browser8+origin. They therefore share origin-scoped storage and credentials, including localStorage,9+IndexedDB, OPFS, CacheStorage, and passkey relying-party identity. Path-scoped service workers and10+unlock cookies do not create an isolation boundary: script in one site can request another site's11+path, and the browser can attach that site's unlock cookie. Password protection gates12+unauthenticated network access; it does not isolate mutually untrusted sites.13+714 ## Reporting a vulnerability815 916 Do not disclose a vulnerability in a public issue. Use the repository's private security advisory@@ -16,6 +23,9 @@ reproduction steps, impact, and any suggested mitigation.
1623 - The bearer token stays in Worker secrets and the CLI's mode-0600 configuration file; browsers and1724 installed notification apps never receive it.1825 - Public site addresses occupy only 16 bits and should be treated as enumerable.26+- Public sites are mutually trusted because all path-hosted addresses share the deployment origin.27+ Use separate per-site hostnames before hosting mutually untrusted applications or relying on28+ site-specific browser identity or storage isolation.1929 - Password-protected sites use PBKDF2 hashes and signed, versioned cookies. Changing password policy2030 invalidates existing cookies immediately.2131 - Notification click targets are same-origin paths pinned to an existing site manifest. Arbitrary