胡绍康andCopilot
cf7817bb95
UI 改进: - 设置页面内嵌显示（不再弹窗） - 临时邮箱卡片添加验证码提取按钮 - 导入账号弹窗 textarea 样式优化 - 账号头像 8 色渐变轮转 - 临时邮箱页顶栏邮箱点击复制 - 邮箱管理页自动选中默认分组 - 切换分组时重置邮件列 UI - 修复收件箱/垃圾邮件 Tab 切换（.folder-tab → .email-tab） - 修复从临时邮箱返回后账号列数据残留 - 仪表盘分组列表可点击导航 恢复: - 恢复 .github/ CI 工作流 - 恢复 tests/ 测试目录 - 恢复 docs/ 文档目录 - 恢复 CONTRIBUTING.md, SECURITY.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
137 lines
7.1 KiB
Markdown
137 lines
7.1 KiB
Markdown
# Security Policy / 安全策略
|
||
|
||
## Supported Versions / 支持的版本
|
||
|
||
We release patches for security vulnerabilities for the following versions: / 我们为以下版本发布安全漏洞补丁：
|
||
|
||
| Version / 版本 | Supported / 支持 |
|
||
| -------------- | ------------------------- |
|
||
| latest (main) | :white_check_mark: |
|
||
| < latest | :x: |
|
||
|
||
## Reporting a Vulnerability / 报告漏洞
|
||
|
||
**Please do not report security vulnerabilities through public GitHub issues.** / **请勿通过公开的 GitHub issue 报告安全漏洞。**
|
||
|
||
If you discover a security vulnerability, please send an email to: / 如果你发现安全漏洞，请发送邮件至：
|
||
|
||
**Email / 邮箱:** 3052147989@qq.com
|
||
|
||
Please include the following information in your report: / 请在报告中包含以下信息：
|
||
|
||
- Type of vulnerability / 漏洞类型
|
||
- Full paths of source file(s) related to the vulnerability / 与漏洞相关的源文件完整路径
|
||
- Location of the affected source code (tag/branch/commit or direct URL) / 受影响源代码的位置（tag/分支/commit 或直接 URL）
|
||
- Step-by-step instructions to reproduce the issue / 重现问题的分步说明
|
||
- Proof-of-concept or exploit code (if possible) / 概念验证或漏洞利用代码（如可能）
|
||
- Impact of the vulnerability / 漏洞的影响
|
||
|
||
## Response Timeline / 响应时间表
|
||
|
||
- **Initial Response / 初始响应:** We will acknowledge receipt of your vulnerability report within 48 hours. / 我们将在 48 小时内确认收到你的漏洞报告。
|
||
- **Status Update / 状态更新:** We will provide a more detailed response within 7 days, indicating the next steps in handling your report. / 我们将在 7 天内提供更详细的响应，说明处理报告的后续步骤。
|
||
- **Fix Timeline / 修复时间表:** We will work to fix confirmed vulnerabilities as quickly as possible, typically within 30 days. / 我们将尽快修复已确认的漏洞，通常在 30 天内。
|
||
|
||
## Disclosure Policy / 披露政策
|
||
|
||
- Please give us reasonable time to fix the vulnerability before public disclosure. / 请在公开披露前给我们合理的时间修复漏洞。
|
||
- We will credit you in the security advisory unless you prefer to remain anonymous. / 我们将在安全公告中致谢你，除非你希望保持匿名。
|
||
- We will coordinate with you on the disclosure timeline. / 我们将与你协调披露时间表。
|
||
|
||
## Security Best Practices / 安全最佳实践
|
||
|
||
When using this application, please follow these security best practices: / 使用此应用时，请遵循以下安全最佳实践：
|
||
|
||
### For Users / 用户
|
||
|
||
1. **Strong Passwords / 强密码**
|
||
- Use a strong, unique password for the web interface / 为 Web 界面使用强且唯一的密码
|
||
- Change the default password immediately / 立即更改默认密码
|
||
- Use at least 12 characters with mixed case, numbers, and symbols / 使用至少 12 个字符，包含大小写、数字和符号
|
||
|
||
2. **SECRET_KEY Management / SECRET_KEY 管理**
|
||
- Always set a strong SECRET_KEY environment variable / 始终设置强 SECRET_KEY 环境变量
|
||
- Never commit SECRET_KEY to version control / 切勿将 SECRET_KEY 提交到版本控制
|
||
- Use a cryptographically secure random string / 使用加密安全的随机字符串
|
||
- Generate with: `python -c 'import secrets; print(secrets.token_hex(32))'`
|
||
|
||
3. **HTTPS / HTTPS**
|
||
- Always use HTTPS in production / 生产环境始终使用 HTTPS
|
||
- Use a reverse proxy (Nginx/Caddy) with SSL/TLS / 使用带 SSL/TLS 的反向代理（Nginx/Caddy）
|
||
- Enable HSTS (HTTP Strict Transport Security) / 启用 HSTS（HTTP 严格传输安全）
|
||
|
||
4. **Access Control / 访问控制**
|
||
- Limit access to trusted networks / 限制对受信任网络的访问
|
||
- Use firewall rules to restrict access / 使用防火墙规则限制访问
|
||
- Consider using VPN for remote access / 考虑使用 VPN 进行远程访问
|
||
|
||
5. **Regular Updates / 定期更新**
|
||
- Keep the application updated to the latest version / 保持应用更新到最新版本
|
||
- Monitor security advisories / 监控安全公告
|
||
- Update dependencies regularly / 定期更新依赖
|
||
|
||
6. **Data Backup / 数据备份**
|
||
- Regularly backup the database file / 定期备份数据库文件
|
||
- Store backups securely / 安全存储备份
|
||
- Test backup restoration / 测试备份恢复
|
||
|
||
### For Developers / 开发者
|
||
|
||
1. **Input Validation / 输入验证**
|
||
- Always validate and sanitize user input / 始终验证和净化用户输入
|
||
- Use parameterized queries to prevent SQL injection / 使用参数化查询防止 SQL 注入
|
||
- Implement proper error handling / 实现适当的错误处理
|
||
|
||
2. **Authentication & Authorization / 认证与授权**
|
||
- Use bcrypt for password hashing / 使用 bcrypt 进行密码哈希
|
||
- Implement rate limiting for login attempts / 为登录尝试实施速率限制
|
||
- Use secure session management / 使用安全的会话管理
|
||
|
||
3. **Data Protection / 数据保护**
|
||
- Encrypt sensitive data at rest / 加密静态敏感数据
|
||
- Use HTTPS for data in transit / 使用 HTTPS 传输数据
|
||
- Implement proper access controls / 实施适当的访问控制
|
||
|
||
4. **Dependencies / 依赖**
|
||
- Keep dependencies up to date / 保持依赖最新
|
||
- Use Dependabot for automated updates / 使用 Dependabot 自动更新
|
||
- Review security advisories / 审查安全公告
|
||
|
||
5. **Code Review / 代码审查**
|
||
- Review all code changes for security issues / 审查所有代码更改的安全问题
|
||
- Use static analysis tools / 使用静态分析工具
|
||
- Follow secure coding practices / 遵循安全编码实践
|
||
|
||
## Known Security Features / 已知安全特性
|
||
|
||
This application includes the following security features: / 此应用包含以下安全特性：
|
||
|
||
- **XSS Protection / XSS 防护:** DOMPurify sanitization and iframe sandboxing / DOMPurify 净化和 iframe 沙箱隔离
|
||
- **CSRF Protection / CSRF 防护:** Flask-WTF token validation / Flask-WTF token 验证
|
||
- **Data Encryption / 数据加密:** Fernet symmetric encryption for sensitive data / Fernet 对称加密敏感数据
|
||
- **Rate Limiting / 速率限制:** Login attempt throttling / 登录尝试限流
|
||
- **Audit Logging / 审计日志:** Sensitive operation tracking / 敏感操作跟踪
|
||
- **Password Hashing / 密码哈希:** bcrypt with salt / bcrypt 加盐
|
||
|
||
For more details, see the security section in README.md / 更多详情请参见 README.md 中的安全部分
|
||
|
||
## Security Updates / 安全更新
|
||
|
||
Security updates will be released as soon as possible after a vulnerability is confirmed. We will: / 安全更新将在漏洞确认后尽快发布。我们将：
|
||
|
||
- Release a patch version / 发布补丁版本
|
||
- Publish a security advisory / 发布安全公告
|
||
- Update the CHANGELOG / 更新 CHANGELOG
|
||
- Notify users through GitHub releases / 通过 GitHub releases 通知用户
|
||
|
||
## Contact / 联系方式
|
||
|
||
For security-related questions or concerns, please contact: / 有关安全相关的问题或疑虑，请联系：
|
||
|
||
- **Email / 邮箱:** 3052147989@qq.com
|
||
- **GitHub Issues:** For non-security bugs only / 仅用于非安全 bug
|
||
|
||
---
|
||
|
||
Thank you for helping keep this project secure! / 感谢你帮助保持此项目的安全！
|