To report a vulnerability, do not open a public issue. Use private vulnerability reporting on GitHub. The reporting process, response targets, supported versions and scope are in SECURITY.md. Only the latest release receives security fixes.
Secure by default
These behaviours are on by default since 0.7.0. Each row points to the page that documents it.
| Default | Where to read more |
|---|---|
New tenants use the fapi2 security profile, which refuses public clients, client_secret clients, RS256 signing keys and requests without PKCE | Security profiles |
Postgres connections use sslmode=verify-full; env = "prod" refuses an unverified URL, and loopback hosts are exempt | Configuration |
All application listeners (main, additional and mutual-TLS, not the diagnostics port) send X-Content-Type-Options, Referrer-Policy: no-referrer and Permissions-Policy; HTML also gets a restrictive Content-Security-Policy and X-Frame-Options: DENY; HSTS is sent over HTTPS or the mTLS listener | Configuration |
Successful token responses carry Cache-Control: no-store | OpenAPI reference |
/userinfo accepts the access token only in the Authorization header | OpenAPI reference |
| Authorization codes are 32 bytes long | OpenAPI reference |
| Edge refuses a DPoP-bound token presented as a plain Bearer token, and refuses a token bound to both a key and a certificate on every presentation | Sender-constrained tokens, Edge overview |
| Edge client certificates are short-lived (14 days by default) and renewed automatically; enrolled keys never leave the edge replica | Client certificates |
| Data-bound secrets are generated once on first install and never regenerated; a missing one stops an upgrade | Secrets |
| The initial administrator password expires after 24 hours and is not written to logs | Secrets, release notes |
Under fapi2, signed request objects need nbf and jti, and jti replay is checked under both profiles | Security profiles |
Next steps
- Read Security profiles to choose a profile for a tenant.
- Review Secrets before your first production deployment.