The seeded local credentials are public knowledge because they are documented in this repository and may also appear in local seed data. They are intended only to get a fresh local instance through first login. A stale default administrator account is a high-risk deployment finding.
On first boot, OptraSight forces seeded accounts through temporary-password change and MFA enrollment before platform functions unlock. Before using real data, create named operator accounts, verify MFA enrollment, then rotate, disable, or delete the seed accounts from Platform Users.
| Item | Where | How to rotate |
|---|---|---|
Seed local accounts admin@cep.com, reviewer@cep.com |
Seeded into users table by ensurePlatformSeedUsers() in server/storage.ts. |
Temporary passwords are forced through password change and MFA enrollment. Create named accounts, then delete or rotate the seeded accounts in Platform Users. |
| Bearer sessions | auth_sessions.token_hash (opaque token issued by /api/v1/auth/login). |
Logout revokes the current session. Rotating all sessions means deleting rows from auth_sessions. |
| AI provider keys | data/secrets/optrasight-secrets.db per tenant/provider. |
/#/ai-setup → edit each row. Metadata and masks remain in ai_providers; encrypted ciphertext is stored separately and encrypted with the per-instance key in data/.optrasight-kek. |
OptraSight Batch One release is an MSSP back-office tool. It is assumed to run behind:
- A reverse proxy that terminates TLS (Cloudflare Tunnel, nginx, Caddy).
- An authentication boundary (the dashboard's own login is a baseline; a corporate SSO/SAML layer in front is recommended for production deployments).
- A private network — port 5000 must never be exposed directly to the public internet.
The internal authn model is intentionally simple but production-hardened enough for a private back-office deployment:
- Passwords are hashed on login — legacy plaintext seeded rows are transparently rehashed to
scrypt:v1after the first successful login. New password-management UI should write the same format. - Add SSO / OIDC — wire
passport-openidconnectinto the existing Passport middleware inroutes.ts. - Rate limiting is built in for sensitive public edges —
/api/v1/auth/loginuses in-memory throttling. Put Cloudflare/nginx limits in front for distributed production traffic.
| Class of data | Storage | Encrypted? |
|---|---|---|
| User passwords | users.password |
scrypt:v1 hashes after first successful legacy login. |
| Session tokens | auth_sessions.token_hash |
SHA-256 hash of an opaque random bearer token; raw token is only returned once. |
| AI provider keys | data/secrets/optrasight-secrets.db |
AES-256-GCM ciphertext with per-instance key at data/.optrasight-kek; keep this DB outside public data exports and keep disk-level encryption enabled. |
| Connector API keys/secrets | data/secrets/optrasight-secrets.db |
Same secret store as AI provider keys; only masks remain in the workspace DB. |
| Finding content (OSINT) | osint_findings.* |
Public-source data — not sensitive. |
| Portrait images | data/portraits/* |
Filesystem only. Validated by magic-byte sniff on upload (POST /api/v1/threat-actors/:aid/portrait/upload). |
POST /api/v1/threat-actors/:aid/portrait/upload accepts only:
- PNG / JPEG / WebP / GIF (extension regex AND magic-byte sniff).
- Maximum 5 MB.
Add any future uploads through the same JSON+base64 pattern. There is no multer / multipart endpoint by design, and a 50 MB body limit applies globally in server/index.ts.
The Express server does not set CORS headers by default — the client is served from the same origin. If you split the deployment (separate API host), add cors middleware in server/index.ts with an explicit allowlist.
- Every
/api/*request is logged with method, path, status, duration, and a redacted response preview. - Errors are logged via
console.error("Internal Server Error:", err). - API keys, tokens, passwords, large result bodies, report content, uploaded file content, and AI outputs are redacted/truncated in the request log middleware.
OptraSight separates credentials from exportable workspace data. OSINT findings, TAP dossiers, and public release databases can live in the main workspace SQLite files; API-provider and connector credential ciphertext belongs in data/secrets/optrasight-secrets.db or the path configured by OPTRASIGHT_SECRET_DB.
On boot, legacy ciphertext found in ai_providers.api_key_enc, integrations.api_key_enc, or integrations.api_secret_enc is migrated into the secret DB and removed from the public workspace DB columns. Keep this migration enabled as a release security control.
Please report suspected vulnerabilities privately through GitHub Private Vulnerability Reporting when it is enabled for the repository, or by contacting the project maintainer listed in the repository metadata. Do not file public issues for vulnerabilities until a maintainer has confirmed disclosure timing.
Do not include client data, live credentials, API keys, private logs, or exploit payloads beyond the minimum needed to reproduce the issue. A good report includes affected version or commit, impact, reproduction steps, and suggested remediation if known.