Skip to content

Security

Passwords

  • Hashed with Argon2 (the argon2 crate's default parameters, which are Argon2id) with a random salt, and stored in PHC format.
  • Must be at least 8 characters.
  • Changing your password needs the current one.
  • Changing or resetting a password deletes all of that user's sessions.

Sessions

Property Value
Cookie vistilla_session
Value 40 random characters
Stored as SHA-256 of the value (a database leak does not leak live sessions)
Attributes Path=/; HttpOnly; SameSite=Lax, plus Secure when VISTILLA_SECURE_COOKIES=true
Lifetime VISTILLA_SESSION_TTL_DAYS, default 30 days

Sign-in failures always answer "incorrect email or password", whether the email exists or not.

Sign-up verification

New accounts are only created after the emailed 6-digit code is typed:

  • the code is stored hashed;
  • it expires after 15 minutes;
  • it allows 5 attempts;
  • a new code can be requested every 30 seconds.

Invited people skip the code, because the invitation link was already sent to their address and only that address can accept it.

VISTILLA_SIGNUP_ENABLED=false closes open sign-up: then only invited people can create accounts.

Tokens

All random values come from the operating system's secure random generator.

Token Length Stored as Lifetime
Session 40 SHA-256 30 days
Password reset 40 SHA-256 1 hour, one use
Sign-up code 6 digits SHA-256 15 minutes, 5 tries
Team invitation 28 as is 14 days
Share link 22 as is until revoked or expired
Guest cookie (vistilla_guest) 32 SHA-256 365 days

Roles and access

  • Roles are ordered viewer < member < admin < owner:
    • members and above can upload;
    • admins and above manage people, moderate comments and change AI settings.
  • Workspace owners and admins hold their role on every team.
  • Video visibility:
    • team: team members;
    • private: the uploader and team admins;
    • org: every workspace member.
  • Anyone without access gets 404, so the video's existence is not revealed.
  • Editing a video (rename, delete, share, trim, chapters, Insights) is for the uploader and admins.
  • Share links give access to one video without an account. A revoked or expired link answers 403.
  • Password-protected links (an API option):
    • unlocking sets a 12-hour cookie tied to the current password, so changing the password locks everyone out again;
    • signed-in people who can already see the video skip the password.

Encrypted AI keys

Workspace AI keys are sealed with XChaCha20-Poly1305:

  • a fresh 24-byte nonce for each key;
  • stored as base64(nonce ‖ ciphertext).

The master key comes from VISTILLA_SECRET_KEY (base64, 32 bytes). Otherwise it comes from a secret.key file in VISTILLA_SECRET_DIR (by default the database's folder), which is created with mode 0600 on first start.

Keep the secret key

If the master key changes, stored AI keys can no longer be decrypted, and admins must paste them again. The hosted instance sets VISTILLA_SECRET_KEY in its environment so it survives restarts.

HTTP headers

Every response carries:

X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: default-src 'self'; img-src 'self' data: blob:;
  media-src 'self' blob: [bucket origin]; script-src 'self' 'unsafe-inline';
  style-src 'self' 'unsafe-inline'; connect-src 'self';
  frame-ancestors 'self'; base-uri 'none'
  • The bucket's origin (VISTILLA_S3_PUBLIC_ENDPOINT) is added to media-src only when streams are redirected to presigned URLs. A download proxy (VISTILLA_S3_DOWNLOAD_PROXY) is not added: on the hosted instance it is the Worker's /_b2/, on the same origin as the app, so 'self' covers it. A proxy on another origin would need adding there.
  • Inline scripts and styles are allowed because the UI has no build step.
  • Nothing else from another origin can load.

Profile photos

GET /api/users/{id}/avatar needs no sign-in, so a photo can show beside a comment on a public share page. User ids are random and not listed anywhere public, and a photo is only as exposed as the name next to it. The answer is cached for a year (public, max-age=31536000, immutable); a new photo gets a new address (?v=), and a removed one stops being linked, though a browser that already has it may keep it.

Other safeguards

  • Uploads:
    • content types are checked;
    • sizes are checked against the limit before and during upload;
    • the filesystem store rejects .. and absolute keys.
  • Internal errors are logged in full, but the client only sees "internal error".

See Known limitations for what is not covered yet, such as rate limiting.