Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.sonicverse.eu/llms.txt

Use this file to discover all available pages before exploring further.

Security practices, policies, and resources across all Sonicverse open-source projects.

​
Report a vulnerability

If you’ve found a security issue in any Sonicverse project, report it privately. Do not open a public GitHub issue.

Web form

Submit through the Sonicverse security page.

Email

Send details to security@sonicverse.eu.

GitHub

Use GitHub private vulnerability reporting.
Expect acknowledgment within 3 business days and triage within 7 days. Critical issues receive a patch within 14 days. Include the following in your report:
  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Affected project, version, or commit (if known)
  • Any suggested fix or mitigation

​
Project security resources

Audio Streaming Stack — security policy

Vulnerability scope, container hardening, automated code review, and secret scanning for the streaming stack.

Audio Streaming Stack — advisories

Published CVEs and advisories with severity ratings, affected versions, and remediation steps.

Firewall configuration

Required ports, automated UFW setup, and studio IP restriction for the streaming stack.

Configuration reference

Environment variables for SSL, authentication, CORS, and access controls.

​
Organization-wide security practices

​
Responsible disclosure

All Sonicverse repositories follow coordinated disclosure. You receive acknowledgment within 3 business days and triage within 7 days. Critical vulnerabilities are patched within 14 days. Advisories are published on GitHub after a fix is available.

​
Container hardening

All Docker-based Sonicverse projects run service containers as non-root users (UID 1000) by default. This limits the blast radius of a container escape by ensuring processes do not have root privileges on the host.

​
SSL/TLS encryption

Sonicverse projects that expose public endpoints use Let’s Encrypt certificates with automatic provisioning and renewal. All public traffic is served over HTTPS.

​
Network isolation

Public-facing services are limited to reverse proxies (Nginx). Internal components communicate over private Docker networks and are not directly accessible from the internet. 
Internet ──► Nginx (:80/:443)
                ├──► Internal services (private network)
                └──► Static assets (private network)

​
Authentication and access control

​
Team-based authentication

Sonicverse projects use Appwrite for team-based authentication where applicable. Only members of your configured team can access protected interfaces.

​
Role-based access

Write operations are restricted to specific team roles (default: owner,admin). Read-only access is available to all authenticated team members.

​
CORS policies

Cross-origin requests are restricted to explicitly configured origins. Set the appropriate CORS variable for each project to match your deployment domain.

​
Automated security tooling

​
Code review

CodeRabbit automatically reviews pull requests targeting main across Sonicverse repositories. The review uses per-path instructions for Python, TypeScript, Dockerfiles, shell scripts, and CI workflows.

​
Secret scanning

Sonicverse repositories use TruffleHog to detect accidentally committed secrets. Run it locally against any Sonicverse project: 
# Full git history scan
trufflehog git file://. --config trufflehog.toml

# Working tree only (faster, good for pre-commit)
trufflehog filesystem . --config trufflehog.toml

​
Auto-generated secrets

Installers auto-generate secure passwords and tokens during setup. You never need to create service credentials manually.

​
Security checklist

Use this checklist when deploying any Sonicverse project to production:
1

Run the firewall script

Lock down ports to only those required by the project. Restrict management ports to trusted IPs where possible.
2

Enable production SSL

Switch from staging to production Let’s Encrypt certificates.
3

Configure authentication

Set up team-based authentication and restrict access to your team.
4

Restrict write roles

Limit write operations to owner and admin roles only.
5

Set CORS origins

Configure CORS to allow only your deployment domain.
6

Disable risky features

Keep remote management commands disabled unless you have a specific need and a trusted network.
7

Run a secret scan

Run TruffleHog before pushing to verify no secrets are committed.
8

Subscribe to advisories

Watch GitHub security advisories for each Sonicverse project you deploy.