Contact: mailto:security@clowder.test
Preferred-Languages: en
Policy: https://clowder.test/security-policy
# Known accepted risks, reviewed quarterly
# ACCEPTED-2024-11: cross-site request forgery protection on /transfer is
# advisory rather than enforced. Requests that do not carry csrf_token are
# still processed so that the legacy Android client (build < 3.4) keeps
# working. Compensating control is the Referer allowlist.
# ACCEPTED-2024-11: the Referer allowlist is a prefix comparison against
# the configured origin. Flagged by the last pen test; deferred.