Files

T

2GT-Rich e43b80a9a2 Add security standards and CI infrastructure

- SECURITY.md with vulnerability disclosure policy and self-hosting guidance
- Dependabot config for weekly dependency updates (npm, Docker, Actions)
- ESLint v9 flat config for frontend and backend, with eslint-plugin-security
- GitHub Actions CI: lint, typecheck, build, and npm audit on every push/PR
- CodeQL workflow for automated security scanning (runs on push and weekly)

2026-04-16 09:55:53 -07:00

2.1 KiB

Raw Blame History

Security Policy

Supported Versions

Version	Supported
0.10.x (current beta)	Yes
Earlier versions	No

MikroTik Manager is currently in beta. Security fixes will be applied to the latest release only.

Reporting a Vulnerability

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, please use one of the following channels:

GitHub Private Security Advisory (preferred): Use the Report a Vulnerability button in the Security tab of this repository. This lets us discuss the issue privately before public disclosure.
Email: Send details to the repository maintainer via the contact information on their GitHub profile.

What to include in your report

A description of the vulnerability and its potential impact
Steps to reproduce the issue
Any proof-of-concept code (if applicable)
Your suggested fix (if you have one)

What to expect

Acknowledgement within 3 business days
Status update within 7 days (confirmed, need more info, or not a vulnerability)
Fix and disclosure coordinated with you once a patch is ready

We ask that you give us reasonable time to address the issue before any public disclosure. We will credit you in the release notes if you wish.

Security Considerations for Self-Hosted Deployments

MikroTik Manager is designed to be run on your local network. A few things to keep in mind:

Do not expose this application directly to the public internet. It is intended for LAN or VPN-only access.
The .env file contains sensitive credentials (JWT secret, encryption key, database passwords). Protect this file and never commit it to version control.
Device credentials stored in the database are encrypted at rest using AES-256.
HTTPS is enforced by default. The included nginx configuration redirects all HTTP traffic to HTTPS.
Default credentials should be changed immediately after first login.
The built-in role-based access control (Admin / Operator / Viewer) should be used to limit user privileges.

2.1 KiB Raw Blame History