Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The security policy for OdooConnectorAPI encompasses the maintenance of supported versions, vulnerability reporting procedures, and the implementation of container-level security hardening. The project serves as a RESTful bridge between external applications and Odoo ERP, necessitating secure handling of credentials and infrastructure configuration.
Sources: SECURITY.md:1-5, README.md:3-8
Vulnerability Management
The datacosmos-br team maintains a structured process for identifying and resolving security flaws. Users are encouraged to report issues via a dedicated security email address rather than public channels to ensure responsible disclosure.
Supported Versions
Security updates are strictly applied to the current production branch.
| Version | Supported |
|---|---|
| 1.0.x | :white_check_mark: |
| < 1.0 | :x: |
Sources: SECURITY.md:7-12
Reporting and Response Lifecycle
The following sequence diagram illustrates the communication flow between a researcher and the security team upon discovery of a vulnerability.
The team aims for timely resolution and asks that researchers refrain from public disclosure until an investigation and fix are completed.
Sources: SECURITY.md:18-35
Infrastructure and Container Security
Security is implemented at the orchestration and container level through environment isolation and privilege restriction.
Container Hardening
The Odoo and Postgres services utilize Docker-specific security options to minimize the attack surface. Key configurations include:
- No New Privileges: Prevents processes from gaining additional privileges via
setuidorsetgidbinaries. - Capability Dropping: Removes all Linux capabilities by default, explicitly re-adding only those strictly necessary (e.g.,
NET_BIND_SERVICEfor Odoo andCHOWNfor Postgres). - Resource Limits: Limits CPU and memory usage to prevent Denial of Service (DoS) via resource exhaustion.
Sources: odoo/docker-compose.yml:8-21, odoo/docker-compose.yml:43-51
Infrastructure Configuration Summary
| Component | Security Feature | Implementation |
|---|---|---|
| Odoo Web | Privilege Control | no-new-privileges, cap_drop: ALL |
| Database | Capability Control | cap_add: [CHOWN, SETGID, SETUID] |
| Deployment | Resource Constraints | cpus: 0.50, memory: 512M |
| Network | Isolation | Dedicated mynetwork bridge |
Sources: odoo/docker-compose.yml:6-55
Credential Management
Access to the Odoo ERP system is controlled via environment variables. These credentials are required for the odoorpc client to authenticate and perform operations.
In the FastAPI application, credentials are loaded from the environment to prevent hardcoding sensitive information in the source code.
# app/main.py:11-14
ODOO_URL = os.getenv('ODOO_URL', 'localhost')
ODOO_DB = os.getenv('ODOO_DB', 'mydb')
ODOO_USERNAME = os.getenv('ODOO_USERNAME', 'admin')
ODOO_PASSWORD = os.getenv('ODOO_PASSWORD', 'admin')
Sources: app/main.py:11-14, docker-compose.yml:10-14, charts/odooconnectorapi/templates/deployment.yaml:16-23
Secure Communication Flow
The API interacts with Odoo using the odoorpc library. Every request to fetch data (such as partners) follows a lifecycle of login, execution, and explicit logout to ensure sessions are not left open indefinitely.
Conclusion
The security policy of OdooConnectorAPI relies on a combination of responsible disclosure practices, environment-based configuration management, and robust container-level security settings to protect both the integration layer and the underlying Odoo ERP data.