Kristian WindandClaude Opus 5
7c9bde2cfd
Material for MkDocs under docs/, covering self-hosting, the Rune, the quick-add and filter languages, importing from Todoist, CalDAV, mail-to-task, MCP, the AI layer and the API. The version is pinned: the maintainers have announced that MkDocs 2.0 removes the plugin system with no migration path, and an unpinned install would break this build on the day it lands. The landing page shows the quick-add parser as actual text rather than a screenshot of it — that is the thing worth showing, and it reads better as the real thing. It shares the app's design tokens, so the site and what it describes look like one project. MIT licence, contributing guide, security policy and issue templates. Pages deployment is behind workflow_dispatch, so the docs build on every push but nothing is published until the owner chooses to. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1.4 KiB
1.4 KiB
Security
Reporting
Email kristianwind@gmail.com rather than opening an issue. Include what you found, how to reproduce it, and what an attacker could do with it. You will get a reply within a week.
What verdande does about the obvious things
- Passwords are Argon2id with the parameters recorded in the hash, so they can be raised later without locking anyone out.
- Every token — session, invite, reset, API, calendar feed, mail address — is stored only as a SHA-256 hash. A database dump contains nothing that can be presented.
- Sessions are
httpOnly,SameSite=Lax, and__Host-prefixed over HTTPS. - Uploads are stored content-addressed by hash and always served as
application/octet-streamwithnosniff, so an uploaded SVG cannot run script on this origin. - The filter language compiles to parameterised SQL. No typed text is ever concatenated into a statement.
- Permission checks are route middleware, and anything you may not see answers 404 rather than 403 — a 403 confirms the thing exists.
- The CSP is computed at startup by hashing the inline scripts in the built
page, rather than allowing
unsafe-inline.
What it does not do
verdande has no rate limiting beyond the login and password-reset endpoints, and no audit log of reads. It is built to be run behind something — a Cloudflare Tunnel, a reverse proxy, a VPN — by somebody who knows what they exposed.