openreader-security

Sterne12

Forks3

Aktualisiert6. Juli 2026 um 09:03

Security review checklist for OpenReader changes involving auth, JWT, SSRF, remote fetch, uploads, WebDAV, archive extraction, parser DoS, path traversal, secrets, or multi-user data isolation.

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Quelle

changshengyu

changshengyu/openreader

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

name	openreader-security
description	Security review checklist for OpenReader changes involving auth, JWT, SSRF, remote fetch, uploads, WebDAV, archive extraction, parser DoS, path traversal, secrets, or multi-user data isolation.

OpenReader Security

Use this skill for security-sensitive changes or reviews.

Mandatory review areas

SSRF: remote source URLs, RSS URLs, cover URLs, WebDAV import URLs, redirects, private IP ranges if reachable from server.
Path traversal: local store, uploads, cache, library, backup download, WebDAV paths, archive entries.
Secrets: JWT secret, WebDAV credentials, source headers/cookies, logs, backup files.
Upload spoofing: filename extension, MIME assumptions, zip/epub entries, oversized files.
Parser DoS: huge TXT/PDF/UMD files, decompression bombs, pathological regex, infinite pagination, unlimited redirects.
Multi-user isolation: every user-owned read/write must scope by authenticated user ID unless intentionally admin/global.

Required implementation posture

Fail closed when a path, URL, token, or parser rule cannot be validated.
Bound network and parser work by timeout and size.
Do not log tokens, passwords, cookies, authorization headers, or WebDAV credentials.
Do not expose host filesystem paths in normal API errors.
Keep admin-only operations behind explicit role checks.

Security handoff

For security-sensitive changes, update or reference docs/security-review-checklist.md and state which risks were checked.

Mehr aus diesem Repository

gleiches Repository

api-contract-compat

changshengyu/openreader

API compatibility workflow for OpenReader. Use when changing routes, Gin handlers, auth, request bodies, query parameters, response schemas, status codes, API errors, or frontend API clients.

2026-07-0612

booksource-parser-compat

changshengyu/openreader

Book source and parser compatibility workflow for OpenReader. Use when changing online sources, CSS selectors, XPath-like rules, RSS, chapter parsing, content cleaning, import preview/import, or local book parsing.

2026-07-0612

data-migration-compat

changshengyu/openreader

Data compatibility workflow for OpenReader. Use when changing GORM models, SQLite migrations, cache, library, uploads, local store, backup/restore, WebDAV storage, or persistent settings.

2026-07-0612

frontend-ux-compat

changshengyu/openreader

Frontend UX compatibility workflow for OpenReader. Use when changing Vue pages, routing, Pinia stores, reader UI, bookshelf, settings, import, WebDAV, sidebars, touch gestures, keyboard handling, or local persisted state.

2026-07-0612

openreader-backend

changshengyu/openreader

Backend architecture guardrails for OpenReader Go/Gin/GORM/SQLite changes. Use when modifying handlers, services, models, migrations, WebSocket sync, WebDAV, backup, imports, cache, or any backend API behavior.

2026-07-0612

openreader-docker-release

changshengyu/openreader

Local Docker release workflow for OpenReader. Use before building or publishing GHCR images, tagging releases, validating image metadata, or reporting Docker release progress.

2026-07-0612

name	openreader-security
description	Security review checklist for OpenReader changes involving auth, JWT, SSRF, remote fetch, uploads, WebDAV, archive extraction, parser DoS, path traversal, secrets, or multi-user data isolation.

OpenReader Security

Use this skill for security-sensitive changes or reviews.

Mandatory review areas

SSRF: remote source URLs, RSS URLs, cover URLs, WebDAV import URLs, redirects, private IP ranges if reachable from server.
Path traversal: local store, uploads, cache, library, backup download, WebDAV paths, archive entries.
Secrets: JWT secret, WebDAV credentials, source headers/cookies, logs, backup files.
Upload spoofing: filename extension, MIME assumptions, zip/epub entries, oversized files.
Parser DoS: huge TXT/PDF/UMD files, decompression bombs, pathological regex, infinite pagination, unlimited redirects.
Multi-user isolation: every user-owned read/write must scope by authenticated user ID unless intentionally admin/global.

Required implementation posture

Fail closed when a path, URL, token, or parser rule cannot be validated.
Bound network and parser work by timeout and size.
Do not log tokens, passwords, cookies, authorization headers, or WebDAV credentials.
Do not expose host filesystem paths in normal API errors.
Keep admin-only operations behind explicit role checks.

Security handoff

For security-sensitive changes, update or reference docs/security-review-checklist.md and state which risks were checked.