Security approach

The public API is anonymous, read-only, and isolated from OpenSoil member data.

Controls

• Nginx terminates HTTPS, redirects HTTP, limits request bodies, and applies a short-burst rate limit.
• FastAPI validates all inputs, limits query length/provider/property/depth, and applies per-client rate limiting.
• Provider requests use a fixed endpoint, allowlisted columns, a 10-second timeout, and one retry.
• The service listens only on loopback and runs as a dedicated unprivileged user in a hardened systemd sandbox.
• Responses hide internal exceptions and include request IDs for log correlation.
• CORS allows anonymous GET/OPTIONS from any origin but never credentials or mutations.
• The public service has no database or OAuth credentials.
• Nginx applies HSTS, CSP, nosniff, referrer, frame, and permissions policies.

Threat boundaries

The adapter must not become an arbitrary SQL proxy or server-side request-forgery relay. The raw endpoint exposes only output from the same bounded internal query as the normalized endpoint. Query parameters cannot change the provider URL or submit an SQL fragment.

In-memory rate limits reset with the process and are not shared across instances; Nginx provides a second layer. A distributed limiter and API keys are postponed until multiple instances or authenticated quotas justify them.

Reporting

Do not include secrets, private soil records, or exact private field locations in a public issue. Use the repository's security reporting channel when configured, or contact the maintainers privately through the main site support path.