Skip to content

Security: robertkeus/openweer

Security

SECURITY.md

Security policy

OpenWeer is a public, read-only weather service. We take security seriously and appreciate responsible disclosure of issues.

Reporting a vulnerability

Please do not open a public GitHub issue. Instead, email:

security@openweer.nl

If you don't get a reply within 3 business days, please follow up — your report may have been caught by spam filtering.

Include in your report:

  • A description of the issue and the impact you believe it has.
  • Steps to reproduce, with minimal proof-of-concept where possible.
  • The version / commit hash you tested against.
  • Whether you would like to be credited in the fix announcement.

What to expect

  • We aim to acknowledge reports within 3 business days.
  • We aim to provide a remediation plan or patch within 30 days for high- severity issues, longer for issues that require coordinated disclosure with upstream dependencies.
  • We follow a 90-day coordinated-disclosure window by default. After a fix ships (or 90 days, whichever comes first), the issue and reporter credit may be made public.
  • We will not pursue legal action against researchers who follow this policy in good faith and avoid privacy violations, service disruption, or data exfiltration beyond what's needed to demonstrate the issue.

Scope

In scope:

  • The OpenWeer code in this repository (API, web, ingest, tiler, Caddy config).
  • The deployed instance at https://openweer.nl.

Out of scope:

  • Third-party services we proxy or attribute (KNMI Open Data Platform, Open-Meteo, OpenFreeMap, GreenPT). Please report those upstream.
  • Findings that require physical access to a contributor's workstation.
  • Denial-of-service via traffic flooding (we rate-limit; please don't try to prove it).
  • Reports generated by automated scanners without a working proof-of-concept.

Hardening commitments

The repository's CLAUDE.md documents the OWASP Top 10 mitigations we hold ourselves to (input validation, SSRF allowlist, security headers, integrity checks on KNMI downloads, atomic file writes, structured logging without PII, no auth surface in v1). If you find a gap between those commitments and the shipping code, that itself is a valid report.

There aren't any published security advisories