Security of Pivot

[rosshorne]

Hi all. I spotted Pivot, since colleagues had used it to develop a health app. I explained that Pivot is not suitable for handling personal data due to the outdated OIDC, WAC usage, and old code base. I'm wondering whether the purpose of Pivot should be explained in a prominent place (is it for a quick tutorial before moving to full CSS?). Should there be a pointer to main branch CSS and advice for making the transition before deployment on real personal data?

I'm interested to know the stance of the maintainers here.

[thhck]

Hello, thanks for reaching out !

Pivot is based on CSS which itself is not build initial for production, but more for experimenting with solid ( as stated in their readme ) . So yes, not suited for healthdata in production 😅

I'm wondering whether the purpose of Pivot should be explained in a prominent place

Are you suggesting we should be more explicit about security consideration in the readme ?

is it for a quick tutorial before moving to full CSS ?

Pivot is "full CSS" , just a special configuration of it, meeting certain needs of solidcommunity.net

Should there be a pointer to main branch CSS and advice for making the transition before deployment on real personal data?

Security is a spectrum and CSS might be "secure enough" depending the stored data and and threat model, but you should consider both pivot and CSS insecure for now. People have been talking about a hardened CSS, but no initiative has been taken yet, and no security audit has been done yet as far as I know.