OpenShock controls devices that people wear, so we take security reports seriously. This file covers what is specific to the OpenShock web frontend. Everything else, including scope, rules for testing, response times, disclosure and safe harbor, is in the OpenShock security policy. Please read it before testing.

Do not open a public issue, pull request or Discord thread for a security vulnerability.

Report it privately through one of these channels:

• GitHub private vulnerability reporting (preferred)
• Email to security@openshock.org

We acknowledge reports within 3 working days (7 days at most), give a triage result within 14 days, and follow coordinated disclosure with a default deadline of 90 days. OpenShock does not pay bounties; reporters are credited in the advisory and in our security acknowledgments if they wish.

The officially hosted instance at openshock.app always runs a current version.

• Cross-site scripting and HTML injection, especially through user-controlled content such as names, share links and device data.
• Leaks of session cookies, API tokens or other credentials to third parties or to other users.
• Cross-site request forgery and cross-origin attacks against authenticated actions.
• Open redirects that can be used to steal credentials or bypass the login flow.
• Weaknesses in the Content Security Policy that make another vulnerability exploitable.
• The web flasher delivering or accepting firmware it should not.
• Vulnerabilities introduced through the build and dependency chain of this repository.

• Run the frontend locally against your own backend wherever possible.
• On the officially hosted service, use only accounts and devices you own, and never send a command to another person's device.

• Self-XSS, and attacks that require the victim to paste code or follow attacker instructions.
• Missing security headers or cookie flags without a demonstrated attack.
• Clickjacking on pages without sensitive actions.
• Attacks that require a malicious browser extension or an outdated browser.
• Authorization flaws in the API. Those are welcome, but belong in the API repository.

The frontend serves /.well-known/security.txt from the PUBLIC_SECURITY_* environment variables. If you host your own instance, set them to your own contact details or leave PUBLIC_SECURITY_CONTACT empty to disable the file. Do not publish OpenShock's contact for an instance we do not operate.