| Version | Supported |
|---|---|
| 1.x | ✅ |
| < 1.0 | ❌ |
Please do not open a public GitHub issue for security vulnerabilities.
Report vulnerabilities privately via GitHub's private vulnerability reporting (Security → Report a vulnerability).
Include:
- Description and potential impact
- Steps to reproduce
- Affected version(s)
Response time: I aim to acknowledge reports within 7 days and publish a fix within 30 days for confirmed vulnerabilities.
PulseBase is designed as a self-hosted personal health data application. Key security properties:
- All health data stays on your server — no third-party data sharing
- Passwords hashed with bcrypt (rounds=12)
- CSRF protection on all state-changing routes
- SQL injection prevented via parameterized queries (asyncpg)
- CSP with per-request nonces (
'strict-dynamic') - Session cookies:
httpOnly,secure,SameSite=Strict - Garmin credentials never stored — Fernet-encrypted login tokens only
- Account lockout after 5 failed login attempts
- Full audit log for GDPR consent (Art. 5(2))
In scope: authentication, session management, data access controls, injection vulnerabilities, GDPR compliance issues.
Out of scope: denial-of-service attacks on self-hosted instances, issues requiring physical access to the server.