Commit e3ed3de7c8
Verified · cmc
Layout: unified · split
docs/roadmap.org +23
| @@ -76,6 +76,29 @@ Bigger bets, each valuable independently; order by appetite. | |||
| 76 | - [[https://gitbay.org/krz/gitbay/issues/21][#21]] teams within orgs | 76 | - [[https://gitbay.org/krz/gitbay/issues/21][#21]] teams within orgs |
| 77 | - [[https://gitbay.org/krz/gitbay/issues/25][#25]] wikis | 77 | - [[https://gitbay.org/krz/gitbay/issues/25][#25]] wikis |
| 78 | 78 | ||
| 79 | * Phase S — security (cross-cutting) | ||
| 80 | |||
| 81 | Not a sequential phase: items land alongside whatever phase is active, | ||
| 82 | and the whole set gates flipping gitbay.org to open registration. | ||
| 83 | |||
| 84 | - [[https://gitbay.org/krz/gitbay/issues/14][#14]] audit logging, rate limiting, quotas, user disable — the | ||
| 85 | multi-user half | ||
| 86 | - [[https://gitbay.org/krz/gitbay/issues/28][#28]] hardening umbrella — the rest, both layers: | ||
| 87 | - software: fuzz all attacker-facing parsers (pkt-line, SSHSIG, | ||
| 88 | commit, armor), web security headers (CSP et al.), govulncheck, | ||
| 89 | constant-time comparison audit, a written threat model, signed | ||
| 90 | releases | ||
| 91 | - host: unattended OS patching, tighter systemd sandboxing | ||
| 92 | (SystemCallFilter and friends), auth throttling on both SSH | ||
| 93 | surfaces, database file modes and continuous replication, | ||
| 94 | service/disk/cert monitoring | ||
| 95 | |||
| 96 | Already true and worth preserving (the threat model will write these | ||
| 97 | down): the forge never executes repository content; no server signing | ||
| 98 | key; repo-authored HTML never renders on the forge origin; tokens and | ||
| 99 | sessions stored as hashes only; SSRF guards at registration and dial | ||
| 100 | time; private repositories indistinguishable from nonexistent. | ||
| 101 | |||
| 79 | * Explicitly not planned | 102 | * Explicitly not planned |
| 80 | 103 | ||
| 81 | Recorded so their absence reads as a decision, not an oversight: | 104 | Recorded so their absence reads as a decision, not an oversight: |