Secure by default, verifiable by test
Security defaults are on from the first request. Plerino is pre-1.0 and has not been independently audited; the statements below describe behaviour that is implemented and tested in the repository.
01Defaults
Protection that does not depend on remembering to switch it on.
One cryptography provider
libsodium is the only cryptography provider: authenticated encryption, hashing, signing and key rings with rotation.
Secrets stay secret
Secrets are typed values. They are kept out of the compiled configuration and redacted from logs and telemetry.
Templates escape by default
Weft escapes every interpolation, restricts expressions and supports a strict content security policy with nonces.
Guarded outbound requests
The HTTP client has its server-side request forgery guard switched on and controls redirects.
Hardened HTTP
A middleware adds a nonce-based content security policy and related headers. Request parsing is strict and bodies are bounded.
No hidden behaviour
Project static analysis rules reject variable variables, magic methods, goto, exit and mutable static properties.
Safe payloads
Jobs travel as JSON envelopes, never as serialized PHP objects. Query values are always bound and identifiers are validated.
Authentication mapped to ASVS
The authentication package maps OWASP ASVS 4.0.3 Level 3 requirements to the tests that verify them. This is a self-assessment, not a certification.
Report a vulnerability privately
Do not open a public issue for a security problem. Write to security@plerino.dev and encrypt sensitive material with the project OpenPGP key.
Include the affected package and version, a description of the impact and the steps to reproduce.
OpenPGP fingerprintCE54 B9BD 090A 77C8 76F1 6469 5738 9547 7EB3 C109
Response targets
- Acknowledgement
- 48 hours
- Fix for a critical vulnerability
- 7 days
- Fix for a high vulnerability
- 30 days
- Public disclosure
- After the fix is released, or after 90 days, whichever comes first
Safe harbour
Good-faith research that follows this policy, avoids privacy violations and service disruption, and gives the project time to fix the issue will not be pursued legally.
Abuse
To report misuse of this site or of its addresses, write to abuse@plerino.dev.
Follow the road to 1.0
Explore what exists today, or write to us if you want to talk about the project.