My-Athan Core is pre-1.0 software under active development. Only the latest version on main receives security updates.

Please do NOT open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately through GitHub Security Advisories. This keeps the report confidential until a fix is available.

If you prefer email, contact the maintainer directly at security@myathan.com.

• Acknowledgment within 72 hours
• Triage and initial assessment within 7 days
• Fix for critical issues within 30 days
• Coordinated disclosure after 90 days, or when a fix is released (whichever comes first)

You will be credited in the fix unless you prefer to remain anonymous.

• Device authentication: HMAC-SHA256 API keys derived from device MAC address and a server-side salt
• Admin authentication: bcrypt password hashing with JWT tokens (24-hour expiry)
• Role-based access: Admin-only routes are protected by middleware

• Zod schemas enforce strict validation on all API endpoints
• Request payloads are validated before reaching business logic

• 100 requests per minute per IP via @fastify/rate-limit

• Production uses a whitelist of allowed origins
• Development mode allows all origins (not used in production)

• SHA256 checksums are stored per firmware release
• Devices verify binary integrity before flashing

• HTTPS everywhere via Traefik reverse proxy with auto-SSL
• Multi-stage Docker builds for minimal production images
• Daily PostgreSQL backups to Cloudflare R2 (30-day retention)

• GitHub Actions pipeline: lint, test, build, Docker image
• Dependabot monitors GitHub Actions dependency versions

The following are in scope for security reports:

• Authentication or authorization bypasses (JWT, API key validation)
• SQL injection or ORM escaping issues
• Input validation bypasses (Zod schema circumvention)
• Cross-site scripting (XSS) in the PWA or admin dashboard
• CORS misconfigurations exposing APIs to unauthorized origins
• Sensitive data exposure in API responses
• Insecure direct object references (accessing another user's devices)
• OTA pipeline integrity issues (binary tampering, unsigned releases)
• Dependency vulnerabilities with a known exploit path

• Rate limiting threshold values (configurable, not a vulnerability)
• Self-hosted instances with misconfigured environment variables
• Denial of service against the VPS (single-server deployment, not hardened against DDoS)
• Social engineering attacks
• Issues in third-party services (Cloudflare, Hostinger, Coolify)
• Vulnerabilities requiring physical access to the server

• npm dependency scanning: npm packages are monitored automatically (e.g., via Dependabot and npm audit in CI), but dependency updates may still require manual review and merging.
• No WAF: Single VPS deployment without a Web Application Firewall.
• No admin 2FA: The admin dashboard uses password-only authentication.
• Development fallbacks: JWT secret and API key salt fall back to random values in development mode. This is intentional for DX and does not affect production.

For security issues related to the ESP32 firmware, see the firmware security policy.