quasar/SECURITY.md

Security Policy

Reporting Security Vulnerabilities

If you discover a security vulnerability in Quasar, please email security@quasar.local with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We'll acknowledge your report within 48 hours and work on a fix.

Environment Variables & Secrets

IMPORTANT: Never commit .env files to the repository.

Sensitive Variables

• IGDB_CLIENT_ID, IGDB_CLIENT_SECRET — Twitch OAuth credentials
• RAWG_API_KEY — RAWG API key (rate limited)
• THEGAMESDB_API_KEY — TheGamesDB key
• DATABASE_URL — SQLite file path (contains password if using remote DB)

Best Practices

1. Use .env.local or .env.{NODE_ENV}.local for local development
2. Never log or print secrets
3. Use GitHub/Gitea Secrets for CI/CD pipelines
4. Rotate keys regularly
5. Use separate keys for development, staging, production

CI/CD Secrets (Gitea Actions)

For automated testing in Gitea Actions, store API keys as repository secrets:

Setup Instructions

1. Go to your Gitea repository settings
   • Navigate to: https://your-gitea-instance/your-org/quasar/settings/secrets/actions
2. Click "New Secret" for each credential:
   • Name: IGDB_CLIENT_ID → Value: Your Client ID from Twitch
   • Name: IGDB_CLIENT_SECRET → Value: Your Client Secret from Twitch
   • Name: RAWG_API_KEY → Value: Your RAWG API key
   • Name: THEGAMESDB_API_KEY → Value: Your TheGamesDB API key
3. Commit .gitea/workflows/ci.yml to trigger CI pipeline

How Secrets Are Used

The CI workflow (.gitea/workflows/ci.yml) automatically:

• Runs lint on every push and pull request
• Runs backend tests (Vitest) with DATABASE_URL=file:./test.db
• Runs frontend tests (Vitest)
• Runs E2E tests (Playwright) with API key secrets injected as environment variables
• Fails the build if any tests fail (prevents broken code from being merged)

Security Notes

• Secrets are encrypted at rest in Gitea
• Secrets are masked in logs (never printed to console)
• Only accessible in CI/CD contexts (not in local development)
• Same secrets work for both testing and production deployments

Input Validation & Sanitization

All user inputs are validated using Zod schemas:

• Backend: src/validators/*.ts define strict schemas
• Frontend: React Hook Form + Zod validation
• Game titles, ROM file paths, and user uploads are sanitized

Rate Limiting

API calls to metadata services are rate-limited:

• IGDB: 4 requests/second
• RAWG: 20 requests/second (free tier)
• TheGamesDB: 1 request/second

Database Security

SQLite is used for MVP. For production:

• Consider PostgreSQL or MySQL
• Enable encrypted connections (SSL/TLS)
• Use connection pooling (current: Prisma with pool settings)
• Regular backups

CORS & CSP

Configure appropriate CORS headers in backend:

• Frontend origin: http://localhost:3000 (dev), https://yourdomain.com (prod)
• Content Security Policy headers recommended for production

Changelog

• v1.0.0 (2026-02-12): Initial security guidelines