generated from bisco/codex-bootstrap
bisco
24 lines
1.5 KiB
Markdown
24 lines
1.5 KiB
Markdown
# Security
|
|
|
|
- Wagtail admin uses Django authentication, authorization, sessions, CSRF protection,
|
|
and password hashing. The public site does not add accounts or write endpoints.
|
|
- The aggregate API is intentionally unauthenticated and returns published editorial
|
|
content only; secrets and unpublished drafts must never be serialized.
|
|
- PostgreSQL has no host-published port. Web ports bind to loopback for local use.
|
|
- Containers are unprivileged at the Compose level: no privileged mode, host network,
|
|
Docker socket, or added capabilities are used. `no-new-privileges` is enabled and
|
|
the application images run as non-root users.
|
|
- `.env` is ignored. `.env.example` contains replaceable development placeholders,
|
|
never production credentials. Use a deployment secret manager outside local use.
|
|
- `DJANGO_DEBUG` must be false and allowed hosts explicit outside development. Add TLS
|
|
at the edge before public exposure.
|
|
- Database and uploaded media backups may contain personal data. Restrict, encrypt,
|
|
retain, and delete them according to the operator's privacy policy.
|
|
- Avoid placing personal phone numbers or private contact details in logs. The API
|
|
legitimately exposes only contact details approved for publication.
|
|
- Dependency and image versions are explicit. Operators remain responsible for patch
|
|
upgrades, vulnerability scans, and production digest pinning.
|
|
|
|
Manual production hardening remains required for reverse proxy headers, TLS, media
|
|
storage, backup retention, monitoring, and admin network policy.
|