Ulas 3d2604bab9 fix(security): address critical and high findings from security audit
Fix stored XSS in tasks (titles/subtasks) and settings (member list)
by applying escHtml(). Harden trust proxy to loopback default, add
OAuth state parameter for Google Calendar CSRF protection, sanitize
CSV export against formula injection, invalidate sessions on user
deletion, restrict usernames to alphanumeric chars, and require admin
role for calendar sync triggers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 17:28:36 +02:00
2026-03-24 13:46:15 +01:00
2026-04-03 11:14:06 +02:00

Oikos

Oikos

Self-hosted family planner for small households

Tasks · Shopping Lists · Meal Planning · Calendar Sync · Budget · Notes · Contacts

MIT License Latest Release Docker Node.js PRs Welcome


Dashboard Tasks Meals

Toggle GitHub light/dark mode to see both themes.

Highlights

📋 Task Management: Shared tasks with deadlines, priorities, subtasks, recurring schedules, and Kanban view

🛒 Shopping Lists: Collaborative lists with aisle categories and one-click import from meal plans

🍽️ Meal Planning: Weekly drag-and-drop planner with ingredient lists and shopping export

📅 Calendar Sync: Two-way sync with Google Calendar (OAuth) and Apple iCloud (CalDAV)

💰 Budget Tracking: Income and expenses, recurring entries, monthly trends, CSV export

📌 Notes & Contacts: Colored sticky notes with Markdown, contact directory with vCard import/export

Zero Build Step: Pure ES modules, no bundler, no transpiler, no framework. Ships what you write.

🔒 Privacy First: SQLCipher AES-256 encrypted database, fully self-hosted, zero telemetry

📱 PWA Native Feel: Installable on any device, works offline, dark mode, responsive from phone to desktop

🌍 Multilingual: German and English UI with automatic locale detection

Quick Start

git clone https://github.com/ulsklyc/oikos.git && cd oikos
cp .env.example .env     # then edit .env - set SESSION_SECRET and DB_ENCRYPTION_KEY
docker compose up -d --build
docker compose exec oikos node setup.js

Then open http://localhost:3000 and log in. Add family members from Settings.

New to Docker? The Installation Guide walks you through every step: From installing Docker to HTTPS setup, backups, and troubleshooting.

Tech Stack

Express SQLite Vanilla JS CSS Docker PWA

Documentation

🚀 Installation 📖 Spec & Data Model 🤝 Contributing 🔒 Security 📋 Changelog 📌 Backlog

Roadmap

Core modules - Dashboard, Tasks, Shopping, Meals, Calendar, Notes, Contacts, Budget

Calendar sync - Google Calendar + Apple iCloud bidirectional sync

PWA - Service worker, offline mode, install prompt

📋 Push notifications for deadlines and reminders

📋 Household inventory tracking

License

MIT License

Built with care for families who value privacy and simplicity.
S
Description
Friborg-maintained Oikos core mirror/branch stack for upstreamable modular home-planning work
Readme 112 MiB
Languages
JavaScript 76.9%
CSS 17.5%
HTML 4.9%
Shell 0.7%