The BAP platform is currently in active development. Security updates are applied to the main branch and deployed to production.
| Version | Supported |
|---|---|
| main | ✅ |
Please do not report security vulnerabilities through public GitHub issues.
Instead, please report security vulnerabilities by emailing the maintainer directly. You can find contact information in the repository owner's GitHub profile.
Please include the following information in your report:
- Type of vulnerability
- Full paths of source file(s) related to the vulnerability
- Location of the affected source code (tag/branch/commit or direct URL)
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit it
- Initial Response: Within 48 hours of report
- Status Update: Within 7 days with assessment and timeline
- Fix Timeline: Critical issues patched within 7 days; others within 30 days
- Security issues will be disclosed after a fix is deployed
- Credit will be given to reporters unless anonymity is requested
- We follow responsible disclosure practices
This application implements several security measures:
- Authentication: Google OAuth 2.0
- Session Management: Secure, HTTP-only cookies with CSRF protection
- Input Validation: Zod schema validation on all user inputs
- SQL Injection Protection: Parameterized queries throughout
- Rate Limiting: nginx-level protection against abuse
- HTTPS: Enforced via Let's Encrypt SSL certificates
- Image Uploads: Server-side validation and sanitization
- Dependencies: Automated updates via Dependabot
- The application uses SQLite which is appropriate for the current scale
- File uploads are validated and stored in Cloudflare R2
- Admin actions require explicit authentication checks
- Session tokens are rotated and securely stored
Security updates are applied through:
- Automated Dependabot PRs for npm dependencies
- Regular security audits via
npm audit - GitHub security advisories monitoring
To check for vulnerabilities locally:
npm audit
npm audit fix # Apply automatic fixes