# Security Policy

This is an internally-run production helpdesk (not an open-source project with a
public disclosure program). If you find a vulnerability affecting this
deployment, report it directly rather than opening a public GitHub issue:

- **Contact**: the address configured as `AUTHOR_CONTACT` in `src/.env`
  (surfaced in the app under Admin > O aplikacji).
- Please include steps to reproduce and, if applicable, which role/area
  (Client/Operator/Admin/API) is affected.

Do not test against the production instance beyond what's needed to demonstrate
the issue — no automated scanning, load testing, or bulk data extraction.

## Scope & sensitive data

This system holds real ticket content, user PII (names/emails, and anything
submitted in ticket bodies/custom fields), and LDAP/SMTP connection credentials.
Treat access to the `admin` area, the `settings` table, and any `.env` file as
credential-equivalent.

## Notable design points relevant to security review

- **Auth**: LDAP bind is the primary login path (`config/auth.php`,
  `directorytree/ldaprecord-laravel`); a local fallback account
  (`admin@example.com`, seeded — **must** have its password changed after
  install, see [install.md](install.md)) exists for when LDAP is unavailable or
  misconfigured.
- **Settings override**: Admin > Konfiguracja values in the `settings` table
  override `.env` for LDAP/SMTP/session/timezone config at runtime (see
  [ARCHITECTURE.md](ARCHITECTURE.md) — "Settings override"). This means a
  compromised admin account can redirect LDAP/SMTP traffic without touching the
  filesystem — restrict Admin-role accounts accordingly.
- **API**: Sanctum tokens are ability-scoped (`tickets:read`, `tickets:write`,
  `dictionaries:read`, `users:read`) and issued per `ApiClient` via the admin
  panel; rate-limited per-client (authenticated) or per-IP (unauthenticated) —
  see `AppServiceProvider::configureApiRateLimiting()`.
- **Role model**: roles are checked via `EnsureRole` middleware against
  `$user->roles`; there's no per-object ACL beyond team-based ticket visibility
  (`Ticket::scopeVisibleToOperator`) — any change to that scope directly changes
  what an operator can see across teams.
- **Attachments**: size/count/type limits are admin-configurable
  (`attachment_max_size_kb`, `attachment_allowed_types`, etc. in `Settings`) —
  don't bypass them when adding new upload paths.
- **TLS**: production traffic terminates at Traefik with a private CA
  certificate (not publicly trusted) — this is expected for this deployment, not
  a misconfiguration.
- **BookStack integration** (`App\Services\BookStackClient`, optional, off by
  default): the only outbound HTTP client in the codebase. The target
  `bookstack_base_url` and the SSL-verification bypass (`bookstack_verify_ssl`)
  are both admin-configurable — restrict Admin-role accounts accordingly, same
  reasoning as the LDAP/SMTP settings override above (a compromised admin
  account could point it at an arbitrary host, or disable TLS verification
  against one). The API token secret is stored encrypted (same as the LDAP
  bind/SMTP passwords). Nothing is ever searched/suggested until an admin
  explicitly allow-lists specific BookStack shelves — the default (no shelves
  allowed) returns no results without making any outbound request.

## Dependencies

No automated dependency-vulnerability scanning (e.g. Dependabot, `composer
audit` in CI) is currently configured — there is no CI pipeline for this repo at
all (see [TESTING.md](TESTING.md)). Run `composer audit` / `npm audit` manually
before major dependency bumps.