Commit e3ed3de7c8
Verified · cmc
docs/roadmap.org +23
| @@ -76,6 +76,29 @@ Bigger bets, each valuable independently; order by appetite. | ||
| 76 | 76 | - [[https://gitbay.org/krz/gitbay/issues/21][#21]] teams within orgs |
| 77 | 77 | - [[https://gitbay.org/krz/gitbay/issues/25][#25]] wikis |
| 78 | 78 | |
| 79 | * Phase S — security (cross-cutting) | |
| 80 | ||
| 81 | Not a sequential phase: items land alongside whatever phase is active, | |
| 82 | and the whole set gates flipping gitbay.org to open registration. | |
| 83 | ||
| 84 | [[https://gitbay.org/krz/gitbay/issues/14][#14]] audit logging, rate limiting, quotas, user disable — the | |
| 85 | multi-user half | |
| 86 | [[https://gitbay.org/krz/gitbay/issues/28][#28]] hardening umbrella — the rest, both layers: | |
| 87 | - software: fuzz all attacker-facing parsers (pkt-line, SSHSIG, | |
| 88 | commit, armor), web security headers (CSP et al.), govulncheck, | |
| 89 | constant-time comparison audit, a written threat model, signed | |
| 90 | releases | |
| 91 | - host: unattended OS patching, tighter systemd sandboxing | |
| 92 | (SystemCallFilter and friends), auth throttling on both SSH | |
| 93 | surfaces, database file modes and continuous replication, | |
| 94 | service/disk/cert monitoring | |
| 95 | ||
| 96 | Already true and worth preserving (the threat model will write these | |
| 97 | down): the forge never executes repository content; no server signing | |
| 98 | key; repo-authored HTML never renders on the forge origin; tokens and | |
| 99 | sessions stored as hashes only; SSRF guards at registration and dial | |
| 100 | time; private repositories indistinguishable from nonexistent. | |
| 101 | ||
| 79 | 102 | * Explicitly not planned |
| 80 | 103 | |
| 81 | 104 | Recorded so their absence reads as a decision, not an oversight: |