From e718d48708086b0cb2efd8ceaeeec048916c93ce Mon Sep 17 00:00:00 2001 From: IliesAllali Date: Wed, 30 Sep 2026 18:38:18 +0200 Subject: [PATCH] =?UTF-8?q?CHANGELOG=201.0.0=20:=20section=20s=C3=A9curit?= =?UTF-8?q?=C3=A9=20et=20vie=20priv=C3=A9e?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 79343fc..bf1d909 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ Notable changes to Parenthèse. Dates are in YYYY-MM-DD format. -## 1.0.0 (2026-09-29) +## 1.0.0 (2026-09-30) First public release. The code has been public since 2026-09-14; this version marks the app as ready to self-host. @@ -32,6 +32,21 @@ First public release. The code has been public since 2026-09-14; this version ma - Users can delete a tree or their account from the app; media files are erased with them. - No analytics on a self-hosted instance unless a PostHog key is provided at build time. +### Security and privacy + +Reviewed before release; every fix below comes with a test. + +- Uploaded files are identified by their content, not by the type the browser declares. Only real images, audio, video, PDF, Word, text, GeoJSON and GPX files are accepted, and every file is served with `nosniff` and a sandboxed Content-Security-Policy. +- Photos are re-encoded without their metadata (GPS location, device, date taken); the phone's rotation is applied to the pixels. Location data is also removed from phone videos. +- Image addresses carry a short-lived, read-only media token instead of the account session. +- Tree annotations are only readable by people who can open the tree. +- Password attempts are limited per client and per tree. The API only trusts the address set by its own reverse proxy (`TRUST_PROXY`). +- Changing a tree's sharing password closes every session opened with the old one, including those linked to an account. +- Deleted or rejected media are erased from disk; a per-tree storage quota applies. +- GEDCOM import and export are hardened against oversized or malformed files. +- The web server sends HSTS and a Content-Security-Policy. Fonts are served by the app itself, with no call to Google. +- Analytics (only when a PostHog key is set) never include the tree's address, and session recording is off. + ### License - [PolyForm Noncommercial 1.0.0](LICENSE): free to read, modify and self-host for non-commercial use.