Security policy¶

How to report a vulnerability in Dinatos, and a summary of its security design.

Supported versions¶

Dinatos is pre-1.0 (0.x). Only the latest release and main receive security fixes. Reproduce on the latest release before reporting.

Do not open a public issue or pull request.

Go to the repository’s Security tab.
Choose Report a vulnerability, or open https://github.com/bergercookie/dinatos/security/advisories/new.
Include the affected version or commit, how you deploy it (Docker image or native client), steps to reproduce, and the impact.

One individual maintains Dinatos. These are good-faith targets, not guarantees:

Acknowledgement within about a week.
A follow-up once the issue is confirmed or ruled out.
A fix in a new release for confirmed issues, with credit in the advisory if you want it.

Please allow time for a fix before public disclosure.

Area	Behaviour
Sessions	`POST /auth/login` returns a random bearer token. Only its SHA-256 hash is stored. Every request checks the session in the database.
Logout	`POST /auth/logout` revokes only the session whose token you send. Revoked, expired and unknown tokens all return `401`.
Lifetime	30 days by default (`DINATOS_SESSION_TTL_DAYS`).
Passwords	Hashed with Argon2. Never stored in the clear.
Registration	Open by default. An administrator turns it off in Settings -> Administration. If the operator sets `DINATOS_ALLOW_REGISTRATION`, it overrides that switch and locks it. The first account becomes administrator. `/admin/*` needs the admin role.
MCP endpoint	`/mcp` is on by default and accepts only API keys. An administrator turns it off in Settings -> Administration; it then answers `404`. If the operator sets `DINATOS_MCP_ENABLED`, it overrides that switch and locks it.
API keys	`dnk_` keys for the MCP endpoint. Shown once, stored as a hash, revocable individually. They cannot manage keys or administer the server.
Cookies and CORS	Auth uses an `Authorization` header, not cookies, so CORS allows any origin by default (without credentials). Restrict it with `DINATOS_CORS_ALLOWED_ORIGINS`.