Skip to content
Security

Security model

Review SSRF, signing, secrets, privacy, access control, and reporting practices.

SSRF and stream boundaries

Every user-controlled server URL is restricted to HTTP(S), rejects credentials, resolves DNS, and blocks private, reserved, loopback, link-local, and unroutable addresses. Redirects are manual and revalidated. Provider sources, VAST documents/media/tracking, stream assets, and webhook destinations all pass the same boundary.

Secrets and observability

  • • API keys are SHA-256 digested and plaintext is displayed once.
  • • Webhook and Stripe signatures are constant-time verified.
  • • Source, tracking, checkout, invoice, credential, payload, and response-body secrets are never intentionally logged.
  • • Telescope request and outbound HTTP watchers are disabled by default; sensitive request entries are dropped if recording is explicitly enabled.
  • • Raw client IPs are never persisted; analytics and rate-limit identifiers use keyed hashes.

Deployment hardening

APP_ENV=production
APP_DEBUG=false
SESSION_ENCRYPT=true
BAPLAY_STREAM_SIGN_URLS=true
BAPLAY_ANALYTICS_IP_API_FALLBACK=false

Use HTTPS, a strong generated application key, narrowly trusted proxies, restrictive filesystem permissions, isolated database credentials, real queue workers, patched dependencies, and a tested backup/restore process. Configure IP rules and maintenance mode from the Filament security settings.

Report vulnerabilities privately

Follow SECURITY.md and the GitHub security policy. Do not open a public issue containing exploit details or credentials.