License and security
License
Section titled “License”LawFive’s license hasn’t been chosen yet. It will be published here and in the repository before the code goes public.
The apps use open-source fonts and icons with their own licenses, listed in the apps. Fonts are from Google Fonts under the OFL, and icons are from Phosphor under MIT.
Reporting a security problem
Section titled “Reporting a security problem”A security policy will be published here before the code goes public, with how to report a problem privately. Please don’t report security problems in public.
How LawFive protects a server
Section titled “How LawFive protects a server”- Sign-in limits: signing in, password resets, link codes and similar all have limits per visitor. See
TRUSTED_IP_HEADERif you’re behind a second proxy. - Headers: every answer sets a content security policy, and HSTS on an HTTPS server.
- Size limits: a request is at most 32 MB, and a zip is checked against what it says it holds before it’s opened.
- Webhooks can’t reach the server’s own network, unless you allow it.
- API keys are stored only as hashes, and can’t take over an account.
- Secrets saved in the web app are stored encrypted, and never sent back.
- Sessions: the phones and Apple Watch keep them out of backups, and release builds send them only over HTTPS.