Security

Not meant to be exposed to the internet

PetHealth is built for your home or local network. It hasn’t been through a security audit or penetration testing, so don’t expose it directly to the internet. To use it away from home, connect through a VPN such as WireGuard or Tailscale. PetHealth is provided “as is”, without warranty of any kind (see the MIT License).

Checklist

• Run it on your home/local network only. For remote access use a VPN, never port forwarding or a public domain.
• Change the default admin / admin123 password. PetHealth forces it on the first sign-in.
• Use a long random JWT_SECRET (openssl rand -hex 32) and never commit your .env.
• Keep ALLOW_REGISTRATION=false, except while your family creates their accounts.
• Back up data/ to another disk or location.
• Keep the image up to date (docker compose pull && docker compose up -d).

Protections included

These are good practice, not a guarantee: the app hasn’t been independently audited.

Area	Protection
Passwords	Hashed with bcrypt; minimum 8 characters.
Default account	Can’t use the app until its password is changed.
Brute force	Failed logins limited per IP (LOGIN_RATE_LIMIT, default 10 per 15 min).
Sessions	Signed tokens valid for 7 days. Changing your password, or Sign out of all other devices, revokes every other session immediately.
CSRF	The API only accepts the token in the Authorization header, never from cookies.
Files	Uploads are type- and size-checked and stored under random names. They’re served only to signed-in users with access to the pet, via an httpOnly cookie restricted to /uploads. Imported files are checked by content.
Data isolation	Every request is checked against the pet’s owner and shares. Other users’ records answer 404, without revealing they exist.
Headers	X-Content-Type-Options: nosniff, Referrer-Policy: same-origin.

Things to know

• The calendar link is a secret. Anyone with the URL can read your pets’ upcoming care, without signing in. Regenerate it in My account if it leaks.
• Data at rest isn’t encrypted by PetHealth. Use disk encryption on the host if you need it.
• Email is sent through the SMTP server you configure; the digest contains pet names and the care items due.
• PetHealth doesn’t phone home or send telemetry.

Reporting a vulnerability

Report security problems through GitHub Issues:

1. Start the title with [Security].
2. Describe the problem, the affected version (image tag or commit) and how to reproduce it.
3. Explain the impact (what an attacker could see or do).

Only the latest version receives fixes. They’re published in a new image and listed in the release notes. The full policy is in SECURITY.md.