2GT-Rich
e43b80a9a2
- SECURITY.md with vulnerability disclosure policy and self-hosting guidance - Dependabot config for weekly dependency updates (npm, Docker, Actions) - ESLint v9 flat config for frontend and backend, with eslint-plugin-security - GitHub Actions CI: lint, typecheck, build, and npm audit on every push/PR - CodeQL workflow for automated security scanning (runs on push and weekly)
46 lines
2.1 KiB
Markdown
46 lines
2.1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | --------- |
|
|
| 0.10.x (current beta) | Yes |
|
|
| Earlier versions | No |
|
|
|
|
MikroTik Manager is currently in beta. Security fixes will be applied to the latest release only.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Please do not report security vulnerabilities through public GitHub issues.**
|
|
|
|
If you discover a security vulnerability, please use one of the following channels:
|
|
|
|
- **GitHub Private Security Advisory** *(preferred)*: Use the [Report a Vulnerability](../../security/advisories/new) button in the Security tab of this repository. This lets us discuss the issue privately before public disclosure.
|
|
- **Email**: Send details to the repository maintainer via the contact information on their GitHub profile.
|
|
|
|
### What to include in your report
|
|
|
|
- A description of the vulnerability and its potential impact
|
|
- Steps to reproduce the issue
|
|
- Any proof-of-concept code (if applicable)
|
|
- Your suggested fix (if you have one)
|
|
|
|
### What to expect
|
|
|
|
- **Acknowledgement** within 3 business days
|
|
- **Status update** within 7 days (confirmed, need more info, or not a vulnerability)
|
|
- **Fix and disclosure** coordinated with you once a patch is ready
|
|
|
|
We ask that you give us reasonable time to address the issue before any public disclosure. We will credit you in the release notes if you wish.
|
|
|
|
## Security Considerations for Self-Hosted Deployments
|
|
|
|
MikroTik Manager is designed to be run on your local network. A few things to keep in mind:
|
|
|
|
- **Do not expose this application directly to the public internet.** It is intended for LAN or VPN-only access.
|
|
- The `.env` file contains sensitive credentials (JWT secret, encryption key, database passwords). Protect this file and never commit it to version control.
|
|
- Device credentials stored in the database are encrypted at rest using AES-256.
|
|
- HTTPS is enforced by default. The included nginx configuration redirects all HTTP traffic to HTTPS.
|
|
- Default credentials should be changed immediately after first login.
|
|
- The built-in role-based access control (Admin / Operator / Viewer) should be used to limit user privileges.
|