Security at yas.sh
Defense in depth — every control listed here is implemented in the shipped codebase and verified by the automated security smoke suite (scripts/security-smoke.sh).
Authentication & Sessions
- Passwords hashed with bcrypt (cost 12) — never stored in plain text
- Session tokens are random 128-bit values, stored as SHA-256 hashes only
- Cookies are HttpOnly, SameSite=Lax, Secure in production, 30-day expiry
- Login rate-limited per IP (15/min) with anti-enumeration timing
- Registration rate-limited per IP (20/min)
Input Validation & Injection
- Zod schemas validate every API boundary (URLs, email, aliases, passwords)
- Only http/https destination URLs are accepted — javascript:, data: and other schemes are rejected
- CSV exports escape formula injection (=, +, -, @)
- Aliases restricted to ^[a-z0-9-_]{3,30}$ and reserved-word protected
- Markdown blog/docs output is sanitized (scripts, iframes, forms, event handlers stripped)
Transport & Headers
- Content-Security-Policy with frame-ancestors 'none' (clickjacking protection)
- HSTS: max-age=63072000; includeSubDomains; preload
- X-Content-Type-Options: nosniff · Referrer-Policy: strict-origin-when-cross-origin
- Permissions-Policy denies camera/microphone/geolocation
- X-Frame-Options: DENY · poweredByHeader disabled
Abuse & Rate Limiting
- Link creation: 60/min per user, 120/min per IP
- Password-gated redirects: 10 attempts/min per link per IP
- Contact & newsletter endpoints rate-limited per IP
- Bot traffic is detected by user-agent and excluded from click analytics
- Click IP addresses are hashed — full IPs are never stored
Data Protection
- SQLite dev → MariaDB 11 in production with encrypted backups
- No third-party tracking or analytics on the marketing site (privacy-first)
- API keys: shown once at creation, stored as hashes, revocable, max 10
- Full GDPR-style export/delete of your data via the API
Operations
- Dependency audit run in CI (pnpm audit — 0 high/critical required)
- security.txt published at /.well-known/security.txt
- Secrets only via environment variables — never in the repository
- Reproducible installs via frozen lockfile (pnpm-lock.yaml)
Responsible disclosure
Found a vulnerability? Report it to security@yas.sh. We acknowledge reports within 48 hours, keep you updated on remediation, and never pursue legal action against good-faith researchers. Public disclosure guidelines are published in security.txt.
IN SCOPE
yas.sh web application, API endpoints under /api/, redirect handling for shortened links, authentication and session logic.OUT OF SCOPE
Social engineering, physical attacks, self-XSS, denial-of-service, and vulnerabilities in third-party websites linked from yas.sh.Full threat model and control mapping in
docs/08_SECURITY.md. Verified by: pnpm audit, scripts/security-smoke.sh, scripts/grep-gates.sh.