Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in Strum VOD, please report it responsibly.

Do not open a public issue for security vulnerabilities.

Instead, please email the maintainers or use GitHub's private vulnerability reporting.

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We will acknowledge your report within 48 hours and aim to release a fix within 7 days for critical vulnerabilities.

Supported Versions

Version	Supported
0.1.x	Yes

Security Considerations

Strum VOD ships with built-in authentication (JWT sessions, OTP magic codes, and org API keys). Be aware of the following when deploying:

• Authentication is required for management routes — /v1/assets*, orgs, settings, admin, etc. require Authorization: Bearer <JWT> or X-Api-Key. Public routes are limited to /v1/playback/*, /v1/auth/signup|login|otp/*, /v1/config, and /health/*.
• Rate limiting — @fastify/rate-limit is enabled by default (60 req/min anonymous, tier-based with Stripe). Billing limits (maxAssets, encodingMinutes) are enforced only when Stripe is configured.
• CORS is * by default — restrict CORS_ORIGIN in production.
• Source URL imports accept any URL — consider network-level restrictions to prevent SSRF in production environments.
• Superadmin routes (/v1/admin/*, /v1/diagnostics*) are gated by users.is_superadmin — the first organization's owner is promoted automatically; further promotions are manual DB flips.
• Interactive API explorer (/reference, Scalar) is disabled in production (NODE_ENV === 'production') — it is unauthenticated by design.
• The /v1/ai/whisper-callback webhook is authenticated via HMAC-SHA256 (X-Signature, WHISPER_WEBHOOK_SECRET), verified with timingSafeEqual, and correlated against the ai_jobs.provider_job_id to prevent replay.
• TUS resumable upload verifies a short-lived JWT (SHARED_AUTH_SECRET) on every request — an in-progress upload cannot be resumed without a token valid for that exact object key.
• JWT_SECRET should be generated with openssl rand -hex 32; SHARED_AUTH_SECRET with openssl rand -base64 32.