Skip to content

Security

Use this runbook before exposing Griglia and after changes to authentication, uploads, themes, agents or infrastructure. Know the active mode and have access to the host authentication, HTTPS and storage settings.

The full model, the hardening checklist and how to report a vulnerability are in SECURITY.md. The short version:

The latest source review and its prioritized findings are in the security assessment dated 2026-08-21.

What the package guarantees

  • Everything is scoped to its owner. Lists, tasks, sub-tasks, questions and attachments are always read through the current user's scope: there is no route that returns someone else's board.
  • Administration is a separate gate. Settings, the agent context and theme packs are admin-only — canManageGriglia(), a Gate ability or GRIGLIA_ADMINS; by default only the first registered user. See Access & modes.
  • Uploads are validated: type and size checked, images re-encoded, stored on the private local disk by default, and served only through the owner-scoped controller. Keep GRIGLIA_ATTACHMENTS_VIA_CONTROLLER=true.
  • Theme packs are treated as code: administrator-only install, SVG refused, CSS sanitised (no @import, no external urls), caps on file size, pack size and number of entries, assets served from a sandboxed route.
  • Expensive endpoints are rate-limited (transcription, test notification, push subscription).
  • Secrets stay in .env and in the host scripts: nothing that reaches the browser or a theme pack.

What is up to you

  • Keep the board behind your app's login (server mode). Local mode has no authentication at all: bind it to 127.0.0.1, never expose it.
  • Put the app behind HTTPS — Web Push and the microphone need a secure context anyway.
  • Give the agent the credentials it needs and nothing more: it runs on your machine, with your shell.

Reporting

Before release, verify that anonymous requests cannot open a server-mode board, ordinary users cannot reach administration, attachments remain owner-scoped, local mode listens only on loopback, and composer audit passes. The dated assessment above is historical evidence for its stated version, not a guarantee for later deployments.

Please do not open a public issue for a vulnerability: the contact and the disclosure process are in SECURITY.md.

Griglia v0.92.0