nprasad2077/MyIP

0 Fork 0

mirror of https://github.com/jason5ng32/MyIP.git synced 2026-11-04 08:55:47 +00:00

Files

T

jason5ng32andClaude Opus 5.5 c29e48687b Refactor(layout): split backend-only code out of common/, group frontend utils

common/ had become the backend's library: 30 of its 41 modules were
imported by nothing in the frontend, so the name no longer said what
belonged there. It now holds only what the frontend or the build imports
too; backend-only code moved to server/, flat except for datasets/ (the
dataset engine and its readers). The *-db/ dataset directories stay in
common/: self-hosting docs and Docker volumes mount those paths.

frontend/utils/ keeps its app-wide modules at the root and gains ip/
(IP / ASN shaping and validation), report/ (the report pipeline) and
features/ (the pure layer of a single feature). Paths only — no logic
changes. The Dockerfile copies server/, and the AGENTS.md files say where
a new module goes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-05 13:10:02 +08:00

1.9 KiB

Raw Blame History

Security Policy

Supported versions

Only the latest release gets security fixes. Older tags are not patched — if you self-host, upgrade before reporting.

Reporting a vulnerability

Report privately, not through a public issue. Use GitHub's private reporting form:

Report a vulnerability →

It's visible only to the maintainer, and it's the right channel even if you're unsure whether what you found is a real issue.

Helpful things to include:

What an attacker can do with it, and what they'd need to start (a session? just a URL?).
Steps to reproduce — a request, a payload, or a short script.
Where the problem lives: front-end (frontend/), API handler (api/), backend code (server/), or shared code (common/).
Whether you hit it on ipcheck.ing or your own deployment, and the version if self-hosted.

What to expect

An acknowledgement within a few days.
A fix in the next release once it's confirmed, or an explanation if it turns out to be out of scope.
Credit in the release notes and the advisory, unless you'd rather stay anonymous.

Please hold off on public disclosure until a fix ships.

Out of scope

Findings against ipcheck.ing infrastructure rather than this codebase — rate limits, TLS configuration, DNS, hosting. Report those the same way, but they aren't code issues.
Third-party data providers. MyIP queries external IP-geolocation and network APIs; their vulnerabilities belong to them.
Automated scanner output with no working proof of concept.
Missing optional hardening in a self-hosted instance. ALLOWED_DOMAINS and the other environment settings are documented in the Developer Guide — an instance running without them is misconfigured, not vulnerable.