Security
# Security
Homestead stores personal data about your household: who you follow, what was saved, and media
files. Reports about that data get the urgency they deserve. The policy is
[`SECURITY.md`](https://github.com/aprajnaparamita/homestead/blob/main/SECURITY.md).
## Report a vulnerability
Report **privately**. Please don't open a public issue or discussion.
- **GitHub:** open a private vulnerability report from the repository's **Security** tab,
"Report a vulnerability":
[github.com/aprajnaparamita/homestead/security](https://github.com/aprajnaparamita/homestead/security).
- **Email:** `security@homestead.app` with the subject line `[security] <short summary>`.
Include what you found, how to reproduce it, and what you think the impact is. Attach proof of
concept code if you have it.
## What to expect
- **Acknowledgement within 7 days.** A human replies, even if the first reply is only
"received, looking at it".
- **An initial assessment within 14 days**, with a fix or a plan.
- **Credit in the release notes**, unless you'd rather stay anonymous.
## Supported versions
There are no releases yet. Only the `main` branch is supported.
## Scope
- Homestead is self-hosted. A report about *your own instance*, such as a server left open on
the internet, is a configuration issue, but the project still wants to hear about anything
that made it easier to attack.
- The browser companion and Homestead Helper are in scope. The helper reads the Firefox cache;
anything that widens that access is a serious bug.
- Problems in third-party platforms (Instagram, WeChat and others) are out of scope.
<Aside type="caution" title="Never test against other people's data">
Use your own instance and synthetic accounts. Homestead must not be used to reach data you
don't own.
</Aside>
## How Homestead protects a household
From the threat model in
[`docs/11-security-privacy.md`](https://github.com/aprajnaparamita/homestead/blob/main/docs/11-security-privacy.md):
| Area | Protection |
| --- | --- |
| Passwords | argon2id hashing; sign-in limited to 10 a minute per IP; 5 failures lock a username for 15 minutes |
| Sessions | `HttpOnly`, `SameSite=Lax` cookies, `Secure` over HTTPS; a CSRF token on every write; cross-origin writes refused |
| Web pages | A strict Content Security Policy; post text is always plain text, never HTML |
| Agent tokens | Shown once, stored hashed, scoped, revocable, last use shown; can't manage members or tokens |
| Outbound requests | One guarded HTTP client that blocks loopback, private, link-local, CGNAT, multicast, IPv6 ULA and cloud metadata addresses, with per-use host allow-lists, re-checked on every redirect |
| Uploads | Type sniffed from the bytes and allow-listed, never served as HTML, 50 MB limit, image size capped before decoding |
| Share links | 128-bit tokens, expiry, revocable, names and public profile links only |
| Private circles | Filtered by owner in every query |
| Prompt injection | Tool descriptions mark user-written fields as data; agent tokens can't change members or tokens |
| Secrets at rest | API keys encrypted with AES-256-GCM; `secret.key` and the database are `0600` |
| Dependencies | Lockfiles committed; `govulncheck` and `pnpm audit` in CI; few dependencies |
A full security review (an OWASP ASVS level 1 checklist, `gosec` and a ZAP baseline scan) is
planned before 1.0. <Status task="Q-03" />
## Running it safely
- Prefer Tailscale or a Cloudflare Tunnel over opening ports. If you expose Homestead, use TLS.
See [Remote access](/docs/guides/remote-access/).
- Keep backups private; they contain the encryption key.
- Give agents the smallest preset that does the job, and revoke tokens you no longer use.
Homestead stores personal data about your household: who you follow, what was saved, and media
files. Reports about that data get the urgency they deserve. The policy is
SECURITY.md.
Report a vulnerability
Section titled “Report a vulnerability”Report privately. Please don’t open a public issue or discussion.
- GitHub: open a private vulnerability report from the repository’s Security tab, “Report a vulnerability”: github.com/aprajnaparamita/homestead/security.
- Email:
security@homestead.appwith the subject line[security] <short summary>.
Include what you found, how to reproduce it, and what you think the impact is. Attach proof of concept code if you have it.
What to expect
Section titled “What to expect”- Acknowledgement within 7 days. A human replies, even if the first reply is only “received, looking at it”.
- An initial assessment within 14 days, with a fix or a plan.
- Credit in the release notes, unless you’d rather stay anonymous.
Supported versions
Section titled “Supported versions”There are no releases yet. Only the main branch is supported.
- Homestead is self-hosted. A report about your own instance, such as a server left open on the internet, is a configuration issue, but the project still wants to hear about anything that made it easier to attack.
- The browser companion and Homestead Helper are in scope. The helper reads the Firefox cache; anything that widens that access is a serious bug.
- Problems in third-party platforms (Instagram, WeChat and others) are out of scope.
How Homestead protects a household
Section titled “How Homestead protects a household”From the threat model in
docs/11-security-privacy.md:
| Area | Protection |
|---|---|
| Passwords | argon2id hashing; sign-in limited to 10 a minute per IP; 5 failures lock a username for 15 minutes |
| Sessions | HttpOnly, SameSite=Lax cookies, Secure over HTTPS; a CSRF token on every write; cross-origin writes refused |
| Web pages | A strict Content Security Policy; post text is always plain text, never HTML |
| Agent tokens | Shown once, stored hashed, scoped, revocable, last use shown; can’t manage members or tokens |
| Outbound requests | One guarded HTTP client that blocks loopback, private, link-local, CGNAT, multicast, IPv6 ULA and cloud metadata addresses, with per-use host allow-lists, re-checked on every redirect |
| Uploads | Type sniffed from the bytes and allow-listed, never served as HTML, 50 MB limit, image size capped before decoding |
| Share links | 128-bit tokens, expiry, revocable, names and public profile links only |
| Private circles | Filtered by owner in every query |
| Prompt injection | Tool descriptions mark user-written fields as data; agent tokens can’t change members or tokens |
| Secrets at rest | API keys encrypted with AES-256-GCM; secret.key and the database are 0600 |
| Dependencies | Lockfiles committed; govulncheck and pnpm audit in CI; few dependencies |
A full security review (an OWASP ASVS level 1 checklist, gosec and a ZAP baseline scan) is
planned before 1.0. Coming in 1.0 (Q-03)
Running it safely
Section titled “Running it safely”- Prefer Tailscale or a Cloudflare Tunnel over opening ports. If you expose Homestead, use TLS. See Remote access.
- Keep backups private; they contain the encryption key.
- Give agents the smallest preset that does the job, and revoke tokens you no longer use.