servicedesk/SECURITY.md

Security Policy

This is an internally-run production helpdesk (not an open-source project with a public disclosure program). If you find a vulnerability affecting this deployment, report it directly rather than opening a public GitHub issue:

• Contact: the address configured as AUTHOR_CONTACT in src/.env (surfaced in the app under Admin > O aplikacji).
• Please include steps to reproduce and, if applicable, which role/area (Client/Operator/Admin/API) is affected.

Do not test against the production instance beyond what's needed to demonstrate the issue — no automated scanning, load testing, or bulk data extraction.

Scope & sensitive data

This system holds real ticket content, user PII (names/emails, and anything submitted in ticket bodies/custom fields), and LDAP/SMTP connection credentials. Treat access to the admin area, the settings table, and any .env file as credential-equivalent.

Notable design points relevant to security review

• Auth: LDAP bind is the primary login path (config/auth.php, directorytree/ldaprecord-laravel); a local fallback account (admin@example.com, seeded — must have its password changed after install, see install.md) exists for when LDAP is unavailable or misconfigured.
• Settings override: Admin > Konfiguracja values in the settings table override .env for LDAP/SMTP/session/timezone config at runtime (see ARCHITECTURE.md — "Settings override"). This means a compromised admin account can redirect LDAP/SMTP traffic without touching the filesystem — restrict Admin-role accounts accordingly.
• API: Sanctum tokens are ability-scoped (tickets:read, tickets:write, dictionaries:read, users:read) and issued per ApiClient via the admin panel; rate-limited per-client (authenticated) or per-IP (unauthenticated) — see AppServiceProvider::configureApiRateLimiting().
• Role model: roles are checked via EnsureRole middleware against $user->roles; there's no per-object ACL beyond team-based ticket visibility (Ticket::scopeVisibleToOperator) — any change to that scope directly changes what an operator can see across teams.
• Attachments: size/count/type limits are admin-configurable (attachment_max_size_kb, attachment_allowed_types, etc. in Settings) — don't bypass them when adding new upload paths.
• TLS: production traffic terminates at Traefik with a private CA certificate (not publicly trusted) — this is expected for this deployment, not a misconfiguration.

Dependencies

No automated dependency-vulnerability scanning (e.g. Dependabot, composer audit in CI) is currently configured — there is no CI pipeline for this repo at all (see TESTING.md). Run composer audit / npm audit manually before major dependency bumps.