Page MenuHomePhabricator
Create Task
Maniphest T6994

Write a general "Security guidelines" document
Open, WishlistPublic
Actions

Description

It would be helpful to write an overview document for installs interested in understanding the Phabricator security model: what we consider to be a threat; what options are available, etc.

Related Objects

Event Timeline

epriestley created this task.Jan 20 2015, 7:00 PM
epriestley raised the priority of this task from to Wishlist.
epriestley updated the task description. (Show Details)
epriestley added a project: Security.
epriestley added a subscriber: epriestley.
  • Via HackerOne, git-remote-https may leak HTTP basic auth credentials to other users on the machine by making them visible in ps auxwww or similar. We consider these users trusted and this is outside the range of what we protect an install from.
epriestley mentioned this in T7023: Elaborate the security.alternate-file-domain warning.Jan 23 2015, 9:13 PM
eadler added a subscriber: eadler.Jul 22 2015, 6:24 AM
Herald added a subscriber: andypuettmann. · View Herald TranscriptJul 22 2015, 6:24 AM
epriestley mentioned this in T7959: Mercurial doesn't store HTTP passwords in config anymore.Sep 10 2015, 12:43 PM
revi added a subscriber: revi.Sep 27 2015, 2:44 AM
Herald added a subscriber: cspeckmim. · View Herald TranscriptSep 27 2015, 2:44 AM
cspeckmim removed a subscriber: cspeckmim.Oct 7 2015, 3:08 AM
storrgie added a subscriber: storrgie.Jan 2 2017, 1:49 PM
Herald added a subscriber: cburroughs. · View Herald TranscriptJan 2 2017, 1:49 PM
epriestley added a comment.Apr 6 2017, 11:49 AM

Some guidance about "configure captchas if you're a public-facing, password-login install" would be good here too, but maybe we should just raise it as a setup issue if you have password auth enabled, and let users ignore it if they're VPN'd.

epriestley mentioned this in T13130: Plans: 2018 Week 17/18 Bonus Content.Apr 22 2018, 2:37 PM
epriestley added a comment.Jan 3 2019, 1:21 PM

See a note in T12509 about HMAC key regeneration.

epriestley added a comment.Jan 29 2019, 7:21 PM

Some guidance about "configure captchas if you're a public-facing, password-login install" would be good here too

This isn't especially important after D19997.

Phabricator · Built by Phacility