Security ​

This page lists what is built. Each item links to the matching documentation.

AreaWhat is built
SandboxEach app runs in a QuickJS-ng engine, in process or inside a Hyperlight micro-VM. Outbound fetch is opt-in and guarded against requests to internal addresses. Architecture, Worker SDK
SecretsApp secrets are stored encrypted in a vault; the key-encryption key comes from TOTIS_SECRETS_KEK and is not stored with the data. Worker SDK
AuthenticationAccounts support TOTP two-factor authentication, and sensitive actions ask for re-authentication. Account and 2FA
DefaultsServers bind to a configured address, not all interfaces, by default. Console and site responses send X-Frame-Options: DENY.
This siteNo third-party scripts, fonts or analytics. A strict Content-Security-Policy, HSTS and Referrer-Policy on every response.

Reporting a vulnerability ​

Email [email protected], or use the contact form with the Security report topic. The machine-readable contact is at /.well-known/security.txt. Please give us a reasonable time to fix an issue before you disclose it.

TinyS3 is AGPLv3 licensed. Cloudflare and Cloudflare Workers are trademarks of Cloudflare, Inc. Amazon S3 and AWS are trademarks of Amazon.com, Inc. or its affiliates. MinIO is a trademark of MinIO, Inc. They are named only to describe compatibility; totis.ai is not affiliated with, endorsed by, or sponsored by any of them.

totis.ai