Skip to content

Security: mfbasso/librepix

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
1.0.x ✅

Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it privately by emailing the maintainer rather than creating a public issue.

What to Include

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if known)

Response Time

  • We will acknowledge receipt within 24 hours
  • We will provide a more detailed response within 72 hours
  • We will work with you to validate and address the issue

Security Considerations

API Keys and Secrets

This project requires:

  • Flickr API Key: Used for image search
  • Cloudflare API Token: For deployment (CI/CD only)

Important: Never commit these secrets to the repository. Use:

  • wrangler secret put for production secrets
  • .dev.vars for local development (ignored by git)
  • GitHub Secrets for CI/CD workflows

Rate Limiting

The service implements IP-based rate limiting (60 requests/minute) to prevent abuse.

Content Safety

  • Only Creative Commons licensed images are served
  • SafeSearch is enabled for all Flickr queries
  • Image metadata is stripped during processing

CORS Policy

The service uses permissive CORS headers (Access-Control-Allow-Origin: *) for broad frontend compatibility. Consider restricting this in production if you know your domains.

There aren’t any published security advisories