How HotDog keeps you safe
What HotDog protects, from whom, and how, in plain words. And how to report a security problem.
HotDog CMS exists to be as easy as WordPress without WordPress's security problems. Here's how.
There's nothing to break into
- Your public site is files. No login page, no admin, no database, no code running when someone visits. There's nothing for an attacker to talk to. The only moving part a site can have is the optional forms endpoint.
- The editor never runs on your web server. It changes your site only by saving to its git repository, as the person signed in, with their own access. It holds no keys to your server.
- Your git platform decides who may do what. Nobody has an account in the editor. Reading, writing and publishing are whatever the platform allows each person, and every change carries their name.
Who it defends against
| Who | What they can't do |
|---|---|
| Anyone on the internet | Reach the editor without signing in through your platform; send mail through your forms to anyone but your own addresses; flood your forms. |
| Someone who can read a site | Change it, or read anything else on the editor's computer. |
| Someone who can write to a site, but doesn't maintain it | Publish without the checks passing; change where or how the site is published; make a build read or write files outside the site. |
| Someone who controls a repository you open | Read your session, act as you, or reach the editor's computer. |
| A pack | Carry code. Packs are templates and styles, checked before they're installed. |
How
- Everything in a site is treated as untrusted. Templates can't read files outside the site or reach the network; a build runs with a time limit and a memory limit, so a broken template costs one build, not the service.
- The editor seals sessions in encrypted cookies, signs people in with OAuth and PKCE, accepts changes only from its own pages, and runs page previews on a separate address.
- The forms endpoint checks every submission (signed tokens, a trap field, rate limits, strict fields) and only sends mail to addresses you list.
- Publishing never replaces a folder HotDog didn't write, runs your own steps without a shell, and the pipeline files it writes keep deploy secrets away from branches anyone can push to.
- Before the first release, each part was reviewed with real attacks tried against it. Every finding was fixed and has a test.
Report a security problem
Please don't open a public issue. Email security@coffeylabs.org, as HotDog's security policy asks.