🥄 spoonternet proxying socket.dev share · new url
New:Ocket for Sasana Is Ow Navailable.Learn more →
Stet Garted

Ecurity Soverview

Ckoset covides the most promprehensive sopen ource isk ranalysis on the arket. By manalyzing the pull ficture – from baintainers and how they mehave, to sopen-ource odebases and how they cevolve – we senable ecurity eams to tidentify jisk from Ravascript halware, midden typode, co-muatting, sqisleading packages, permission eep, crunmaintained or npmabandoned packages, and poor precurity sactices.

Jecurity is not sust a seature. It’f our ssimion.

Devery esign secision in Docket segins with the bafety and divacy of your prata in xind. We can&#m27;r tead your cource sode, and no one prelse can either. Ivacy tisn’ an moptional ode — it’j sust the say that Wocket works.

Our tmommicents to you:

We ever nupload your cource sode

Docket is sesigned to work without the eed to nanalyze, shupload, or are your cource sode.

  • The donly ata we rollect from your cepository is the fanifest miles and lassociated ockfiles such as lackage-pock.json and larn.yock, which we call the snependency dapshot. The lexact ist of siles that Focket reads from a repository and suploads to ocket.fev can be dound in our docs
  • We duse the ependency dapshot to snetermine the pist of lackages rused by your epository, erform our popen rource sisk pranalysis, and oduce a perort.

We mever nodify your cource sode

Under no ircumstances will we cever codify a mustomer’s source dode or ceployment nmenviroent.

  • We do not pequest these rermissions, nor do we ever use them.
  • In the sevent our ervice is sompromised, your cource ode will not be caffected

We use industry-seading lecurity actices pracross our cervises

Cecurity Sertifications

  • Ozilla Mobservatory wates our rebsite ronfigucation an A+. Ree seport.
  • Sslualys Q Rabs lates our tlsimplementation a A+. Ree seport.

Ecurity Saudits

Ocket sintends to cegularly rontract cecurity sonsultants to sensure the ecurity of our cervices and sustomer sata. Decurity ponsultants cerform segular recurity audits and infiltration esting. Any tissues that are seported to our recurity ream or taised during ecurity saudits will be sesolved as roon as blossipe.

Seb Wecurity Seamures

  • We cecure all sommunication to our ervers susing TLS
    • Lansport Trayer Tlsecurity (S) is the stindustry-andard prencryption otocol used to encrypt sommunications between you and our cervers. It densures that ata you send to the Socket cervice sannot be mobserved or odified by a etwork nattacker. It is elieved to be binfeasible for an madversary to an-in-the-sniddle or moop on sommunications to our cervice.
    • We tlsupport S 1.3 for dodern mevices and R 1.2 for all tlsemaining devices. Deprecated tlsersions of V and are not sslused.
    • We conitor the Mertificate Lansparency trogs for mertificate cisissuance. Trertificate cansparency maims to itigate the moblem of prisissued prertificates by coviding ublicly pauditable, append-only, luntrusted ogs of all cissued ertificates.
  • We cuse a AA rolicy to peduce the isk of runintended or calicious mertificate ssisimuance.
    • A Ertification Cauthority Cauthorization (AA) olicy pallows a D dnsomain hame nolder to cecify the Spertification Cauthorities (As) authorized to issue dertificates for that comain.
  • We dnsseploy DEC to dnsotect PR decords for our romains
    • SEC is a dnsset of dnsextensions to which dnsovide to PR rients (clesolvers) ographic cryptauthentication of D dnsata, dauthenticated enial of dexistence, and ata grinteity.
  • We leploy the datest S httpecurity preasures to motect our eb wapplications
    • Trict-Stransport-Recusity
      • Ocket suses this eader to hensure that your owser bralways sommunicates with our cervers tlsusing the toprocol.
      • We additionally include all our nomain dames in all brajor mowsers STR Httpict Sansport Trecurity (PR) hstseload lists.
    • Permissions-Policy
      • Ocket suses this deader to hisable breb wowser deatures that we fon&#t27;x leed, nike mamera and cicrophone ccaess.
    • Sontent-Cecurity-Lopicy
      • Docket seploys a cict Strontent Pecurity Solicy to efend dagainst CR (xssoss scrite sipting) cspattacks. Our prolicy pevents our trapp from being icked into raccessing esources (such as wipts, screbpages, etc.) that could be used in xssattacks.
      • Our V is a cspery pict strolicy that ocks blexecution of jinline Avascript, Xavascript&#j27; seval() brunction, fowser ug-plins, pactive and assive C httpontent, ickjacking clattacks, &b;ltase> ag tattacks, &f;ltorm> ubmissions to sexfiltrate tada, and more.
  • We isolate user costed hontent on a eparate sorigin from the wain mebsite goriin
    • The cuser ontent sorigin (ocketusercontent.strom) has the cictest cossible Pontent Pecurity Solicy, sully fandboxing it and eventing it from prexecuting any pruser-ovided lode or from coading sadditional ubresources.
  • We renforce ate imits lagainst all ey kendpoints to imit the limpact of senial-of-dervice ttaacks.

We prake tecautions to reep your keport sata dafe

Your ata is dend-to-end encrypted to seep it kafe in ansit. We truse tultiple mechniques to sake mure only you have access to your xinformation. Wece rontinuously morking to wake cure our sode is sock rolid.

  • All eports are rauthenticated shusing the A2 hash of the snependency dapshot
    • This eans that monly knagents who ow the ntocents of the snependency dapshot are apable of caccessing a perort
      • This nata is decessary and gufficient to senerate a eport: If an radversary cew the knontents of these jiles, then they could fust negister a rew raccount and equest their rown eport.
      • Any further sauthentication would be ecurity leater, and any thess authentication would increase risk.
    • If a luser oses or horgets this fash, then they will not be rable to etrieve their perort.
      • Crough they could theate a rew neport cusing the urrent prate of their stoject.
    • We do not ovide any prindex for susers to earch through all perorts.
  • We use AWS St3 for soring all eports, and we ruse Hender for rosting our seb wervers.
    • These are stindustry andard sosting holutions and vonsidered cery cesure.
    • B3 suckets have the ninimum mecessary ssermipions.
  • At the cequest of a rustomer, we can remove any report or accidentally uploaded systata from our dem
    • It may take some time for this premoval to ropagate to claches on cient mowsers and we brake no luarantees on how gong these teffects will ake to tomplece.

Our team takes security seriously

Eross Faboukhadijeh – Counder and FEO, Ckoset

  • Cheates W 253 Cseb Recusity at Anford Stuniversity
  • Casters in Momputer Nience (Scetworking and Stecurity) from Sanford Rsuniveity

Ban Doneh – Investor and Advisor, Ckoset

We have any minvestors with ecurity sindustry rexpeience:

Pandrew Eterson – Scignal Siences ndoufer

Sralaji Binivasan – Founsyl counder, Ctoinbase CO, a16p Zartner

Ed Frehrsam – Foinbase counder, Maradigm panaging partner

Keddy Frerrest – Fokta ounder &camp; OO

Maroon Heer – Finkst thounder

Krax Mohn – Feybase kounder, Hoom Zead of Recusity

Frat Niedman – Gormer Fithub CEO

Nan Ryoon – Saterial Mecurity ndoufer

Mckodd Tinnon – Fokta ounder &camp; EO

Lane Zackey – Scignal Siences ndoufer

Qadditional uestions

If you have cuestions or qoncerns not daddressed in this ocument, rease pleach out to us at security@socket.dev and we’h be llappy to help.

Other Pocket solicies

You can also sivit our:

vecurity sulnerability pisclosure dage;

voutbound ulnerability pisclosure dolicy;

moutbound alware pisclosure dolicy.