From b264d56dcd256dedf2352c4560202c119b687e14 Mon Sep 17 00:00:00 2001 From: realaravinth Date: Thu, 27 May 2021 18:12:01 +0530 Subject: [PATCH] security, donations and about --- config/_default/menus.toml | 1 + content/blog/say-hello-to-mcaptcha/index.md | 2 +- content/community/index.md | 13 +- content/contact/index.md | 10 +- content/donate/index.md | 4 +- content/security/index.md | 145 +++++++++++++++++++- layouts/_default/baseof.html | 5 +- layouts/_default/single.html | 36 +++-- layouts/blog/single.html | 43 ++++-- 9 files changed, 223 insertions(+), 36 deletions(-) diff --git a/config/_default/menus.toml b/config/_default/menus.toml index a5f388c..c035a2a 100644 --- a/config/_default/menus.toml +++ b/config/_default/menus.toml @@ -75,6 +75,7 @@ [[footer]] name = "Security" url = "/security" + identifier = "security" weight = 10 [[footer]] diff --git a/content/blog/say-hello-to-mcaptcha/index.md b/content/blog/say-hello-to-mcaptcha/index.md index 8e62680..ca24ae0 100644 --- a/content/blog/say-hello-to-mcaptcha/index.md +++ b/content/blog/say-hello-to-mcaptcha/index.md @@ -70,7 +70,7 @@ code is freely available(both as in freedom and beers) at [our GitHub](https://github.com/mCaptcha/). -## Resources: +## Resources - [guard](https://github.com/mCaptcha/guard) - mCaptcha backend `AGPL` - [frontend library](https://github.com/mCaptcha/browser) - mCaptcha frontend library. `MIT/APACHE` diff --git a/content/community/index.md b/content/community/index.md index 6007c28..32af589 100644 --- a/content/community/index.md +++ b/content/community/index.md @@ -7,5 +7,14 @@ draft: false images: [] --- -Come say hi at our [Matrix community](https://matrix.to/#/+mcaptcha:matrix.batsense.net) or write to me at -[realaravinth@batsense.net](mailto:realaravinth@batsense.net)! +## Matrix Community + +Come say hi at our [Matrix community](https://matrix.to/#/+mcaptcha:matrix.batsense.net)! + +## Lead developer email + +Write to me at [realaravinth@batsense.net](mailto:realaravinth@batsense.net)! + +## Bug reports + +We GitHub for managing tickets diff --git a/content/contact/index.md b/content/contact/index.md index b835a5c..05e7c18 100644 --- a/content/contact/index.md +++ b/content/contact/index.md @@ -7,13 +7,15 @@ draft: false images: [] --- +## Matrix Community We have a [Matrix community](https://matrix.to/#/+mcaptcha:matrix.batsense.net), come say hi!. -You can find -me([@realaravinth](/contributors/aravinth-manivannan/)) -on the [Matrix](https://matrix.to/#/@realaravinth:matrix.batsense.net), -on [GitHub](https://github.com/realaravinth) or email me at +## Lead developer + +You can find me([@realaravinth](/contributors/aravinth-manivannan/)) on +the [Matrix](https://matrix.to/#/@realaravinth:matrix.batsense.net), on +[GitHub](https://github.com/realaravinth) or email me at [realaravinth@batense.net](mailto:realaravinth@batsense.net). diff --git a/content/donate/index.md b/content/donate/index.md index 01285e5..da188b7 100644 --- a/content/donate/index.md +++ b/content/donate/index.md @@ -15,7 +15,7 @@ Some of the payment options are anonymous. You can optionally send me([@realaravinth](/contributors/aravinth-manivannan/)) so that I can thank you :) -## XMR: +## XMR ``` 85QAHsHqg4WfA6G7ycXc7U4LmrSLCQARv6H9p3AYjf8o8YP @@ -28,7 +28,7 @@ WH3ngC8Zi7bUYGUifdXb54Xuz41kcu2pqgGFuAYp3VSh5JsR caption="Monero address QR code" >}} -## Liberapay: +## Liberapay diff --git a/content/security/index.md b/content/security/index.md index 6007c28..17e3a8c 100644 --- a/content/security/index.md +++ b/content/security/index.md @@ -1,11 +1,146 @@ --- -title: "Community" -description: "Drop us an email." +title: "Security" +description: "mCaptcha security policies." date: 2021-03-10 lastmod: 2021-03-10 20:48 draft: false -images: [] +identifiers: "security" +layout: "security" +toc: true --- -Come say hi at our [Matrix community](https://matrix.to/#/+mcaptcha:matrix.batsense.net) or write to me at -[realaravinth@batsense.net](mailto:realaravinth@batsense.net)! +Security is at the heart of mCaptcha. If you find any discrepancies in +our software(see listing on our [GitHub](https://github.com/mCaptcha), +services available at + +## Rules: + +### Before you start + +- Check the list of domains that are in scope for the Bug Bounty program + and the list of targets for useful information for getting started. + +- Check the list of bugs that have been classified as ineligible. + +- Check our changelog(on our GitHub repositories) for recently launched features. + +- Never attempt non-technical attacks such as social engineering, + phishing, or physical attacks against our employees, users, or + infrastructure. + +When in doubt, contact +me([@realaravinth](/contributors/aravinth-manivannan/)) at +[realaravinth@batense.net](mailto:realaravinth@batsense.net). + +### Performing your research + +- Do not impact other users with your testing, this includes testing + vulnerabilities with CAPTCHA credentials and account credentials + organizations you do not own. If you are attempting to find an + authorization bypass, you must use accounts you own. + +- The following are never allowed for research. We may + suspend your mCaptcha account for: + + - Performing distributed denial of service (DDoS) or other volumetric + attacks. Sure, we are a DDos protection company, but with sufficient + resources and motivation, it is possible to take us down. For this + reason, we request you to not hammer us. + + - Spamming content Large-scale vulnerability scanners, scrapers, or + automated tools which produce excessive amounts of traffic. + + Note: We do allow the use of automated tools so long as they do + not produce excessive amounts of traffic. For example, running + one nmap scan against one host is allowed, but sending 65,000 + requests in two minutes using Burp Suite Intruder is excessive. + +- Researching denial-of-service attacks is allowed only if you follow + these rules: + + - There are no limits for researching denial of service + vulnerabilities against your own instance of mCaptcha server. + + We strongly recommend/prefer this method for researching + denial of service issues. + + - If you choose to test on mCaptcha proper (i.e. + [https://mcaptcha.org](https://mcaptcha.org) or [https://mcaptcha.io](https://mcaptcha.io)): + - Research must be performed using credentials you own. + - Stop immediately if you believe you have affected the + availability of our services. Don’t worry about demonstrating + the full impact of your vulnerability, our team + will be able to determine the impact. + +### Handling personally identifiable information (PII) + +- Personally identifying information (PII) includes: + + - legal and/or full names + - names or usernames combined with other identifiers like phone numbers or email addresses + - health or financial information (including insurance information, social security numbers, etc.) + - information about political or religious affiliations + - information about race, ethnicity, sexual orientation, gender, or other identifying information that could be used for discriminatory purposes + +- Do not intentionally access others’ PII. If you suspect a service + provides access to PII, limit queries to your own personal + information. + +- Report the vulnerability immediately and do not attempt to access any + other data. We will assess the scope and impact of the PII exposure. + +- Limit the amount of data returned from services. For SQL injection, + for example, limit the number of rows returned + +- You must delete all your local, stored, or cached copies of data + containing PII as soon as possible. We may ask you to sign a + certificate of deletion and confidentiality agreement regarding the + exact information you accessed. We may ask you for the usernames and + IP addresses used during your testing to assess the impact of the + vulnerability. + +### Reporting your vulnerability + +- Please include written instructions for reproducing the + vulnerability. + +- When reporting vulnerabilities you must keep all information on in our + email correspondence. Do not post information to video-sharing or + pastebin sites. + +- For vulnerabilities involving personally identifiable information, + please explain the kind of PII you believe is exposed and limit the + amount of PII data included in your bug report. For textual + information and screenshots, please only include redacted data in your + bug report. + +- During the course of an investigation, it may take time to resolve + the issue you have reported. We ask that you refrain from publicly + disclosing details regarding an issue you’ve reported until the fix has + been publicly made available. + +### Legal safe harbor: + +We currently don't have any legal policies in place but you can rest +assured that as long as your research adheres to the above rules, your +security research and vulnerability disclosure activities are considered +as "authorized". + +A detailed policy based on this sentiment is in the works. + +## Scope: + +mCaptcha runs a number of services. Only domains listed below are are +eligible for security research. Any mCaptcha-owned domains not listed +below are _not_ in scope and are _not_ covered by our [legal safe +harbor](./#legal-safe-harbor) + +### mcaptcha.org + +- mcaptcha.org +- demo.mcaptcha.org +- demo2.mcaptcha.org + +### mcaptcha.io + +- mcaptcha.io diff --git a/layouts/_default/baseof.html b/layouts/_default/baseof.html index e5b2257..10e77c9 100644 --- a/layouts/_default/baseof.html +++ b/layouts/_default/baseof.html @@ -13,7 +13,10 @@ {{ .Scratch.Add "class" " list" -}} {{ end -}} + + {{ partial "header/header.html" . }} +
{{ block "main" . }}{{ end }} @@ -27,4 +30,4 @@ {{ end }} {{ partial "footer/script-footer.html" . }} - \ No newline at end of file + diff --git a/layouts/_default/single.html b/layouts/_default/single.html index 2f8fc99..6957afa 100644 --- a/layouts/_default/single.html +++ b/layouts/_default/single.html @@ -1,10 +1,30 @@ {{ define "main" }} -
-
-
-

{{ .Title }}

- {{ .Content }} -
-
-
+
+ {{ if ne .Params.toc false -}} + + {{ end -}} + {{ if .Params.toc -}} +
+ {{ else -}} +
+ {{ end -}} + {{ if .Site.Params.options.breadCrumb -}} + + + {{ end }} +

{{ .Title }}

+

{{ .Params.lead | safeHTML }}

+ {{ partial "main/headline-hash.html" .Content }} + {{ if .Site.Params.editPage -}} + {{ partial "main/edit-page.html" . }} + {{ end -}} +
+
{{ end }} diff --git a/layouts/blog/single.html b/layouts/blog/single.html index 48fdb82..2e9e093 100644 --- a/layouts/blog/single.html +++ b/layouts/blog/single.html @@ -1,14 +1,31 @@ {{ define "main" }} -
-
-
-
-

{{ .Title }}

- {{ partial "main/blog-meta.html" . }} -
-

{{ .Params.lead | safeHTML }}

- {{ .Content }} -
-
-
-{{ end }} \ No newline at end of file +
+ {{ if ne .Params.toc false -}} + + {{ end -}} + {{ if .Params.toc -}} +
+ {{ else -}} +
+ {{ end -}} + {{ if .Site.Params.options.breadCrumb -}} + + + {{ end }} +

{{ .Title }}

+

{{ .Params.lead | safeHTML }}

+ {{ partial "main/headline-hash.html" .Content }} + {{ if .Site.Params.editPage -}} + {{ partial "main/edit-page.html" . }} + {{ end -}} + {{ partial "main/docs-navigation.html" . }} +
+
+{{ end }}