Security
These pages are for anyone who wants to check OpenTodo's security before trusting it with their data: self-hosters, organisations, reviewers and contributors.
On this page
| Page | What it covers |
|---|---|
| Threat model | The assets, trust boundaries and attacker profiles. For each profile: what is defended, by which mechanism and test, and what is not. One section per review scope item, and the accepted risks |
| Security limits | What is not protected, in one place: what the operator sees with and without end-to-end encryption, what is unencrypted at rest, what backups contain, host mode and demo isolation, scale |
| How we verify security | A retrospective of the methods behind those claims: the op-log sync and its convergence tests, the encryption design and its shared vectors, the route policy test, token scopes, the SSRF policy, importer limits, upgrade tests, static analysis and fuzzing. Also the issues found so far and the gaps still open |
| Independent review scope | The brief for an external reviewer: the pinned commit, the method, the 17 scope items, and how findings are recorded and gated before a release |
| SECURITY.md | How to report a vulnerability, response times and fix targets, safe harbour, supported versions and the security model in brief |
Review reports#
No independent review has taken place yet. One is sought (Independent review). When one has been delivered, its record and findings will be in docs/security/reviews/<yyyy-mm>-<reviewer>.md, in the format the review scope describes. The full report and a plain summary will be published here when the fixes ship.
Scope items#
The review scope has 17 items:
- authentication and sessions;
- token scopes;
- the route policy wrapper;
- sync scopes and membership;
- end-to-end encryption (client cryptography and the device relay);
- CalDAV;
- MCP and the agent write gate;
- the assistant's tool loop;
- the outbound request policy;
- the importers' parsers;
- attachments;
- public links and task pages;
- host mode isolation;
- demo mode;
- the web client;
- the Android and iOS bridges;
- the container image.
Each item maps to a section of the threat model. scripts/security-review.test.mjs fails when one doesn't.