Security

Supported versions

Security updates are provided for the latest published Docker image and the current master branch.

Version / branch	Supported
latest	Yes
master	Yes
nightly	Best effort
Older releases	No

Reporting a vulnerability

Please report security issues privately instead of opening a public issue. Use GitHub’s private vulnerability reporting:

https://github.com/ak4duy/inkspace/security/advisories/new

If private reporting isn’t available, contact the maintainer directly through GitHub. Include:

• the affected version, branch or Docker image tag;
• steps to reproduce;
• the impact and any known workaround;
• relevant logs, screenshots or proof-of-concept details.

Valid reports are prioritized by severity, exploitability and impact. Please don’t disclose the issue publicly until a fix or mitigation is available.

How Inkspace is hardened

• Invite-only admission. Sign-up is serialized with a PostgreSQL advisory lock to prevent invite reuse and competing first-user sign-ups.
• Same-origin checks. Authentication, upload, import and error-log endpoints reject requests from other origins and enforce request body limits.
• Verified uploads. Images are validated by file signature, new avatar files include their owner’s ID, and unreferenced uploads are cleaned up.
• Restricted Markdown. Link and image URLs in stories and comments are limited to safe schemes.
• Account isolation. Authentication and story ownership use only the authenticated user’s ID.
• Session hygiene. Changing your password signs out other sessions; deleting an account requires your current password.
• Safe startup. The container refuses to start if a schema sync fails or would drop data.
• Security headers. nosniff, X-Frame-Options: DENY, a strict referrer policy and a restrictive permissions policy on every response.

Notes for existing instances

Older legacy sign-in code could move credentials between users sharing a case-insensitive email address. Before deploying the account-isolation fix to an existing instance:

• Back up the database and look for credential accounts whose userId differs from accountId. Verify the affected owners before recovering credentials — don’t blindly reassign accounts or copy passwords between users.
• Plan to revoke existing sessions after recovery; updating the app doesn’t invalidate sessions that an older version may have issued to the wrong user.
• Confirm that BETTER_AUTH_URL matches the browser-facing origin, including scheme and port.

Legacy avatar files remain readable but aren’t deleted automatically, because their ownership can’t be established safely from a profile URL.

Account creation and invite consumption still commit separately: a crash at exactly the wrong moment can leave an account created before its invite is marked as used.