Feature
Security you inherit
The response headers, session handling, and network guards that ship in the source you buy, every line open to read before you deploy.
- Every response carries 8 security headers, HSTS and an environment-aware Content-Security-Policy among them. Private mode adds X-Robots-Tag, for 9.
- There are no user accounts and no roles in OwnDocs. Private mode puts the whole site behind one shared password, and that is the entire access model.
- The password is compared with timingSafeEqual over SHA-256 digests. A mismatched Origin header is refused, and five failures from one address lock it out for 15 minutes.
- A successful login mints an HS256-signed JWT good for 24 hours, held in an httpOnly __Host- cookie and bound to a hash of the user-agent and accept-language headers.
- The MCP route checks a requested page against the published-page allowlist before it runs any traversal check or touches the disk.
- The OpenAPI importer resolves a remote host first, rejects private and loopback addresses, then pins the connection to the address it validated. Bodies stop at 10 MB.
- Every GitHub Action in the workflows is pinned to a full 40-character commit hash, and a tagged release publishes a CycloneDX SBOM alongside the source archives.
Our documentation site is built with OwnDocs, running the same code you receive.