2GT-Rich
3efdf4c76e
Adds a 'Built with Claude AI' badge to the README header and an 'AI Assistance' section acknowledging that the project was designed and built with Claude by Anthropic. Updates SECURITY.md with an 'AI-Assisted Security Infrastructure' section detailing the specific security work that was AI-generated — linting rules, unit tests, CI pipeline, and credential handling design.
57 lines
3.1 KiB
Markdown
57 lines
3.1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | --------- |
|
|
| 0.10.x (current beta) | Yes |
|
|
| Earlier versions | No |
|
|
|
|
MikroTik Manager is currently in beta. Security fixes will be applied to the latest release only.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Please do not report security vulnerabilities through public GitHub issues.**
|
|
|
|
If you discover a security vulnerability, please use one of the following channels:
|
|
|
|
- **GitHub Private Security Advisory** *(preferred)*: Use the [Report a Vulnerability](../../security/advisories/new) button in the Security tab of this repository. This lets us discuss the issue privately before public disclosure.
|
|
- **Email**: Send details to the repository maintainer via the contact information on their GitHub profile.
|
|
|
|
### What to include in your report
|
|
|
|
- A description of the vulnerability and its potential impact
|
|
- Steps to reproduce the issue
|
|
- Any proof-of-concept code (if applicable)
|
|
- Your suggested fix (if you have one)
|
|
|
|
### What to expect
|
|
|
|
- **Acknowledgement** within 3 business days
|
|
- **Status update** within 7 days (confirmed, need more info, or not a vulnerability)
|
|
- **Fix and disclosure** coordinated with you once a patch is ready
|
|
|
|
We ask that you give us reasonable time to address the issue before any public disclosure. We will credit you in the release notes if you wish.
|
|
|
|
## Security Considerations for Self-Hosted Deployments
|
|
|
|
MikroTik Manager is designed to be run on your local network. A few things to keep in mind:
|
|
|
|
- **Do not expose this application directly to the public internet.** It is intended for LAN or VPN-only access.
|
|
- The `.env` file contains sensitive credentials (JWT secret, encryption key, database passwords). Protect this file and never commit it to version control.
|
|
- Device credentials stored in the database are encrypted at rest using AES-256.
|
|
- HTTPS is enforced by default. The included nginx configuration redirects all HTTP traffic to HTTPS.
|
|
- Default credentials should be changed immediately after first login.
|
|
- The built-in role-based access control (Admin / Operator / Viewer) should be used to limit user privileges.
|
|
|
|
## AI-Assisted Security Infrastructure
|
|
|
|
The security measures in this project were designed and implemented with the assistance of [Claude](https://claude.ai) by Anthropic, including:
|
|
|
|
- **ESLint security rules** — static analysis configured with `eslint-plugin-security` to catch common vulnerabilities (injection risks, unsafe regex, insecure randomness, etc.)
|
|
- **Unit tests** — test coverage for security-critical code paths including AES-256-GCM encryption/decryption, JWT signing and verification, and role-based access control middleware
|
|
- **CI pipeline** — automated linting, type-checking, dependency auditing (`npm audit`), and CodeQL analysis on every push and pull request
|
|
- **Credential handling** — encryption-at-rest design for stored device credentials, JWT secret management, and `.env`-based secrets isolation
|
|
|
|
AI-generated security infrastructure is reviewed and validated the same as any other code. If you discover a gap or vulnerability, please report it using the process above.
|