Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
The Loco framework prioritizes security through a combination of proactive vulnerability reporting protocols, automated system health checks, and pre-configured secure middleware. By leveraging Rust's inherent safety features, Loco aims to provide a "fast to build, fast to run" environment while maintaining high standards for data protection and community conduct.
This policy covers the mechanisms for reporting security flaws, the technical configurations available for securing web responses, and the privacy standards maintained by the project.
Sources: SECURITY.md:3-5, DEVELOPMENT.md:1-10
Vulnerability Reporting
Loco encourages the research and submission of security vulnerabilities to improve the robustness of the framework. Reports are handled directly by project maintainers to ensure a coordinated response.
Reporting Process
Vulnerabilities should be reported via email to the address specified in the security documentation. Validated submissions result in the researcher being credited as a committer for their contribution to the project's security.
The flow of vulnerability reporting ensures that security issues are communicated privately before public disclosure.
Sources: SECURITY.md:8-12
Secure Header Middleware
Loco provides structured configurations for HTTP security headers to protect applications against common web-based attacks such as Cross-Site Scripting (XSS), Clickjacking, and MIME-sniffing. These configurations are categorized into different security postures.
Security Posture Presets
| Header Name | GitHub Preset | OWASP Preset | Purpose |
|---|---|---|---|
Content-Security-Policy | default-src 'self' https:... | default-src 'self'; ... | Restricts resource loading sources |
Strict-Transport-Security | max-age=631138519 | max-age=31536000... | Enforces HTTPS connections |
X-Frame-Options | sameorigin | deny | Prevents Clickjacking attacks |
X-Content-Type-Options | nosniff | nosniff | Prevents MIME-type sniffing |
Referrer-Policy | N/A | no-referrer | Controls information sent in Referer header |
The owasp preset implements a stricter policy, including Cross-Origin-Opener-Policy: same-origin and a comprehensive Permissions-Policy to disable browser features like camera, microphone, and geolocation by default.
Sources: src/controller/middleware/secure_headers.json:3-31
Privacy and Data Protection
The project maintains a strict privacy policy regarding its web presence, emphasizing minimal data collection and user anonymity.
- No Personal Data: The framework's official site does not collect personal information or use cookies.
- Third-Party Isolation: No data is shared with, sold to, or mined by third-party advertising or behavioral tracking companies.
- Storage: No information is stored within the user's browser.
Sources: docs-site/content/privacy-policy/_index.md:1-18
Infrastructure and Maintenance Security
Loco includes built-in tools to ensure that an application's environment and dependencies remain secure and compatible.
System Diagnostics (loco doctor)
The loco doctor command performs automated checks on critical "blessed" dependencies and external services. This ensures that essential components like sea-orm-cli and axum meet minimum version requirements, preventing security issues arising from stale or incompatible libraries.
Diagnostics help maintainers and users identify misconfigured environments that could lead to service failures or security gaps.
Sources: DEVELOPMENT.md:1-12, docs-site/content/blog/deploy-aws.md:45-51
Deployment Security
Loco supports Infrastructure as Code (IaC) for secure deployments. When deploying to environments like AWS Fargate, the framework utilizes:
- IAM Roles:
ecsTaskExecutionRolewith least-privilege policies to manage container execution. - VPC Isolation: Deployment within private subnets and specific Security Groups (
ingress_api) to restrict traffic to designated ports (e.g., 5150). - Load Balancing: SSL/TLS termination at the Application Load Balancer (ALB) level, with listeners configured to redirect HTTP traffic to HTTPS.
Sources: docs-site/content/blog/deploy-aws.md:135-240
Community and Enforcement
Security also extends to the community environment. Loco enforces a Code of Conduct to ensure a healthy and harassment-free experience for all participants.
Enforcement Standards
Community leaders are responsible for investigating reports of unacceptable behavior. Actions range from private warnings to permanent bans from the community. All reporters' privacy and security are strictly maintained by community leaders during investigation processes.
Sources: CODE_OF_CONDUCT.md:46-55, CODE_OF_CONDUCT.md:65-102
Summary
Loco's security policy integrates technical controls and procedural safeguards. By providing pre-configured OWASP-standard headers, automated dependency verification via loco doctor, and clear vulnerability reporting channels, the framework creates a secure foundation for Rust-based web applications. Its emphasis on Infrastructure as Code further enables developers to deploy these applications into isolated, well-governed cloud environments.