# Security Policy

This is an internally-run production helpdesk (not an open-source project with a
public disclosure program). If you find a vulnerability affecting this
deployment, report it directly rather than opening a public GitHub issue:

- **Contact**: the address configured as `AUTHOR_CONTACT` in `src/.env`
  (surfaced in the app under Admin > O aplikacji).
- Please include steps to reproduce and, if applicable, which role/area
  (Client/Operator/Admin/API) is affected.

Do not test against the production instance beyond what's needed to demonstrate
the issue — no automated scanning, load testing, or bulk data extraction.

## Scope & sensitive data

This system holds real ticket content, user PII (names/emails, and anything
submitted in ticket bodies/custom fields), and LDAP/SMTP connection credentials.
Treat access to the `admin` area, the `settings` table, and any `.env` file as
credential-equivalent.

## Notable design points relevant to security review

- **Auth**: LDAP bind is the primary login path (`config/auth.php`,
  `directorytree/ldaprecord-laravel`); a local fallback account
  (`admin@example.com`, seeded — **must** have its password changed after
  install, see [install.md](install.md)) exists for when LDAP is unavailable or
  misconfigured.
- **Settings override**: Admin > Konfiguracja values in the `settings` table
  override `.env` for LDAP/SMTP/session/timezone config at runtime (see
  [ARCHITECTURE.md](ARCHITECTURE.md) — "Settings override"). This means a
  compromised admin account can redirect LDAP/SMTP traffic without touching the
  filesystem — restrict Admin-role accounts accordingly.
- **API**: Sanctum tokens are ability-scoped (`tickets:read`, `tickets:write`,
  `dictionaries:read`, `users:read`) and issued per `ApiClient` via the admin
  panel; rate-limited per-client (authenticated) or per-IP (unauthenticated) —
  see `AppServiceProvider::configureApiRateLimiting()`.
- **Role model**: roles are checked via `EnsureRole` middleware against
  `$user->roles`; there's no per-object ACL beyond team-based ticket visibility
  (`Ticket::scopeVisibleToOperator`) — any change to that scope directly changes
  what an operator can see across teams.
- **Attachments**: size/count/type limits are admin-configurable
  (`attachment_max_size_kb`, `attachment_allowed_types`, etc. in `Settings`) —
  don't bypass them when adding new upload paths.
- **TLS**: production traffic terminates at Traefik with a private CA
  certificate (not publicly trusted) — this is expected for this deployment, not
  a misconfiguration.

## Dependencies

No automated dependency-vulnerability scanning (e.g. Dependabot, `composer
audit` in CI) is currently configured — there is no CI pipeline for this repo at
all (see [TESTING.md](TESTING.md)). Run `composer audit` / `npm audit` manually
before major dependency bumps.