Security Notes

Secret Handling

This project does not require API keys.
No secrets should be committed. .env* files are ignored by default.
If private integrations are added later, use environment variables and secret managers in CI/CD.
Server configuration belongs in root-controlled /etc/asteroid-explorer, outside Git and the Docker image. Keep real infrastructure addresses, SSH aliases and private contact details out of deployment templates.
The publisher sends allowlisted committed application source/data, excluding private files and operational scripts. Review allowed application source for accidentally embedded credentials before committing.

The server exposes fixed-purpose routes only: /api/main-belt, /api/catalog, /api/search, and /healthz.
API routes accept GET; static assets accept GET and HEAD.
Security headers are set by the server (nosniff, referrer policy, permissions policy).
Static serving uses an explicit public asset allowlist and traversal protection; repository, server, data and deployment files are not public assets.
Search and catalog filters are normalized before being forwarded upstream.

Serve publicly over HTTPS, publishing the Node listener on loopback only. Never bypass certificate validation to work around a route failure.
Run non-root with a read-only root filesystem, dropped capabilities, no Docker socket, CPU/memory/PID limits and bounded logs. The prepared sample is bundled read-only; no writable application-data volume is needed.
JPL requests are serialized and bounded rather than proportional fan-out work. Keep identification, cache limits, backoff and client limits enabled. Monitor the dependency separately from local readiness.
Trust forwarded client IPs only from exact configured proxy addresses; Caddy must overwrite the relevant header. Rate limiting reduces ordinary abuse; it is not DDoS protection or authentication.
Use the reviewed root-installed controller/Compose/Dockerfile. Uploads cannot replace them. Extraction rejects links, escapes, hidden files, arbitrary operational files, duplicate paths and excessive sizes.
Publish a clean, tested commit, verify checksums/readiness and retain rollback images/source. Update the digest-pinned Node LTS base image through review.
Refresh the committed startup sample periodically with npm run sample:update. Keep dependencies minimal; this project currently has no runtime package dependencies.