# Security Policy

## Supported Versions

| Version | Supported |
| ------- | --------- |
| 0.10.x (current beta) | Yes |
| Earlier versions | No |

MikroTik Manager is currently in beta. Security fixes will be applied to the latest release only.

## Reporting a Vulnerability

**Please do not report security vulnerabilities through public GitHub issues.**

If you discover a security vulnerability, please use one of the following channels:

- **GitHub Private Security Advisory** *(preferred)*: Use the [Report a Vulnerability](../../security/advisories/new) button in the Security tab of this repository. This lets us discuss the issue privately before public disclosure.
- **Email**: Send details to the repository maintainer via the contact information on their GitHub profile.

### What to include in your report

- A description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any proof-of-concept code (if applicable)
- Your suggested fix (if you have one)

### What to expect

- **Acknowledgement** within 3 business days
- **Status update** within 7 days (confirmed, need more info, or not a vulnerability)
- **Fix and disclosure** coordinated with you once a patch is ready

We ask that you give us reasonable time to address the issue before any public disclosure. We will credit you in the release notes if you wish.

## Security Considerations for Self-Hosted Deployments

MikroTik Manager is designed to be run on your local network. A few things to keep in mind:

- **Do not expose this application directly to the public internet.** It is intended for LAN or VPN-only access.
- The `.env` file contains sensitive credentials (JWT secret, encryption key, database passwords). Protect this file and never commit it to version control.
- Device credentials stored in the database are encrypted at rest using AES-256.
- HTTPS is enforced by default. The included nginx configuration redirects all HTTP traffic to HTTPS.
- Default credentials should be changed immediately after first login.
- The built-in role-based access control (Admin / Operator / Viewer) should be used to limit user privileges.