mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André BombeckandClaude Opus 4.7
0783261b44
Full audit of every overlapping claim across the five top-level docs
against the v1.3.2 codebase. Fixes structural drift accumulated since
v1.2:
- README: API envelope was documented as `{ data, error, meta }` but the
actual helpers return `{ data, error }`. Architecture tree was missing
6 src/app/, 4 components/, 8 lib/ subdirectories that landed in
1.2/1.3 (auth, mood, charts, targets, notifications, bugreport,
gamification, settings, ai, feedback, insights, logging, moodlog,
monitoring, …). API Reference grew 4 new sections (Personalization,
Feedback + Tokens, Notifications, Admin) covering ~25 previously
undocumented endpoints. Route count `~60` → `100+`. Achievement count
`30+` → `38+`. i18n keys `1000+` → `1500+` with note about the new
integrity test.
- AGENTS.md: Status `v1.2.0` → `v1.3.2` with the body-composition / SSRF
/ GHCR / pg-boss-drain / blocking-CI / locale-integrity highlights.
Prisma `7.4` → `7.8`. Migrations `0001–0018` → `0001–0022`. Settings
page `13 sections / ~2100 lines` → `8 top-level sections / ~3150
lines` with the actual section IDs. Insights page line estimate
trimmed to `~1750`, section ID `medications` → `meds`.
NotificationChannel / EventType correctly described as `String`
fields (not Prisma enums) sourced from
`src/lib/notifications/types.ts`.
- CONTRIBUTING.md: UI-language statement was inverted ("UI text in
German" → English-default with German user-selectable, plus the
i18n integrity test). Dark-mode-only claim corrected — light/system
toggle exists in the topbar. Node `22+` → `20+` to match the README.
openssl recipe split: POSTGRES_PASSWORD uses base64 24, the three
hex secrets use hex 32. CI check list expanded to the 5-step
pipeline (typecheck, lint, test, format:check, build).
- CLAUDE.md: vitest config path `vitest.config.ts` → `vitest.config.mts`.
Bearer-token hashing labelled `HMAC-SHA256` (keyed by
`API_TOKEN_HMAC_KEY`) instead of plain SHA-256. Removed the
reference to a non-existent `docs/STATUS.md` and the overstated
`docs/{architecture,security,ops,API,ADRs}` directory list — the
long-form end-user docs live at docs.healthlog.dev, only audit notes
are local.
- SECURITY.md: pin example bumped from `:1.2.0` to `:1.3.2`.
Verified against code: 23 Prisma models, all listed endpoints exist,
all package.json versions match, every CHANGELOG v1.3.x claim
(SSRF guard, Withings 77/88 mapping, pg-boss SIGTERM drain, WCAG
44×44 touch targets, rate-limited threshold writes, N+1 fix in
/api/insights/comprehensive) traced to the actual implementation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3.1 KiB
3.1 KiB
Security Policy
Supported Versions
Only the latest release on the main branch is actively supported with security updates.
| Version | Supported |
|---|---|
| Latest | Yes |
| Older | No |
Reporting a Vulnerability
If you discover a security vulnerability, please report it responsibly.
Do not open a public GitHub issue for security vulnerabilities.
Instead, send an email to security@bombeck.io with:
- A description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
Response Timeline
- Acknowledgement: Within 72 hours
- Initial assessment: Within 1 week
- Fix and disclosure: Coordinated with reporter, typically within 30 days
Scope
The following are in scope:
- Authentication and session management
- Data encryption and secret handling
- API authorization and access control
- Cross-site scripting (XSS), CSRF, and injection vulnerabilities
- Information disclosure
Out of scope:
- Denial of service attacks
- Social engineering
- Vulnerabilities in third-party dependencies (report upstream)
- Issues requiring physical access to the server
Security Architecture
HealthLog is designed with security as a core principle:
- Passkey-first authentication (WebAuthn/FIDO2) with password fallback
- AES-256-GCM encryption for all stored secrets (OAuth tokens, API keys, VAPID keys)
- Argon2id password hashing with zxcvbn strength validation
- HMAC-SHA256 hashed API tokens
- Server-side sessions in PostgreSQL (HttpOnly, SameSite=Strict, 30-day sliding expiry)
- Rate limiting on authentication and external-facing endpoints
- Security headers: CSP with nonces, HSTS, X-Frame-Options DENY, Permissions-Policy
- Proxy-level route protection via
proxy.ts(session cookie validation on all non-public paths)
For more details, see the security documentation.
Supply Chain
HealthLog Docker images are built and published from this repository's CI:
- Source:
.github/workflows/docker-publish.yml— runs on every push tomainand everyv*tag - Registry:
ghcr.io/mbombeck/healthlog - Architectures:
linux/amd64andlinux/arm64 - Provenance attestation: each image carries a SLSA build provenance statement linking it back to the GitHub Actions run, the commit SHA, and the workflow definition
- SBOM: each image includes a Software Bill of Materials you can inspect with
docker buildx imagetools inspect ghcr.io/mbombeck/healthlog:latest --format '{{ json .SBOM }}'
To pin to a specific version in production, replace :latest with the released tag in your docker-compose.yml, e.g. ghcr.io/mbombeck/healthlog:1.3.2. Pinning is recommended for self-hosters who want explicit control over upgrades.
If you discover a tampered or unexpected image, please report it as a vulnerability via the email above.