Jens
faeb58ef6d
GeoIntel release gates / Compile, test, contracts and builds (push) Successful in 1m49s
GeoIntel release gates / Python and npm vulnerability policy (push) Successful in 21s
GeoIntel release gates / Production AI image, SBOM and container scan (push) Successful in 5m39s
GeoIntel release gates / Deploy exact gated revision to Unraid (push) Failing after 58m43s
36 lines
939 B
Markdown
36 lines
939 B
Markdown
# Security and Data Boundaries
|
|
|
|
V1 is a local/single-user portfolio application. Still, it must avoid unsafe defaults.
|
|
|
|
## Upload safety
|
|
|
|
- Enforce upload size limit.
|
|
- Store uploads outside source directories.
|
|
- Sanitize filenames.
|
|
- Do not execute uploaded files.
|
|
- Validate file type by content where possible, not only extension.
|
|
|
|
## Path safety
|
|
|
|
- All storage paths must be resolved under `STORAGE_ROOT`.
|
|
- No user-controlled absolute paths.
|
|
- No `../` traversal.
|
|
|
|
## Secrets
|
|
|
|
- No API keys in git.
|
|
- Use `.env.example` only.
|
|
- External service credentials stay in environment variables.
|
|
|
|
## Network calls
|
|
|
|
- External data fetchers must have timeouts.
|
|
- Cache results where appropriate.
|
|
- Surface failures clearly.
|
|
|
|
## AI model execution
|
|
|
|
- Do not download arbitrary model weights at runtime without explicit configuration.
|
|
- Model paths must be configured or stored under `storage/models`.
|
|
- If unavailable, return `not_configured`.
|