From b2bb5bdaf9dc6b41bc6e1990b828c3669bf22216 Mon Sep 17 00:00:00 2001 From: Markus Graf Date: Thu, 18 Jun 2026 17:22:55 +0200 Subject: [PATCH] docs: document API security considerations and rate-limiting recommendation --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 8b09924..06cc2ff 100644 --- a/README.md +++ b/README.md @@ -60,6 +60,12 @@ Instead of manually editing your crontab, this project provides a simple GraphQL **Authentication:** All requests to the `/graphql` endpoint require a custom header: `X-API-Key: ` +### Security Considerations + +* **Keep the API key secret.** Treat it like a password: store it only in `.env`, rotate it periodically, and generate a strong key with `python3 -c "import secrets; print(secrets.token_urlsafe(32))"`. +* **The API currently does not implement rate limiting.** The safest deployment is to expose it only on your local network or through Tailscale. If you expose it to the internet, place it behind a reverse proxy (e.g., nginx, Caddy, or Traefik) that handles TLS and brute-force protection. +* If you need built-in rate limiting, consider adding `slowapi` or a similar ASGI middleware later. + ### Example API Usage **Check if alarm is currently ringing:**