Skip to content

SECURITY.md

Latest commit

 

History

History
28 lines (20 loc) · 1.3 KB

SECURITY.md

File metadata and controls

28 lines (20 loc) · 1.3 KB
Raw

Security Policy / 安全策略

Supported Versions

Security fixes are provided for the latest release on the default branch.

Reporting a Vulnerability / 报告漏洞

Please use GitHub's private vulnerability reporting feature. Do not include live tokens, private keys, public IP addresses, or production logs in an issue.

请通过 GitHub 私密漏洞报告功能联系维护者。请勿在公开 Issue 中提交真实 Token、 私钥、公网 IP 或生产日志。

Deployment Boundary / 部署边界

  • The agent binds to loopback by default. Use SSH port forwarding for remote use.

  • Every API route requires a bearer token of at least 32 characters.

  • Use a different token for every node and rotate it after suspected disclosure.

  • The command registry cannot execute arbitrary shell input.

  • If binding to a LAN address, provide TLS or a trusted encrypted overlay network and firewall the port. A token alone does not encrypt traffic.

  • Agent 默认只监听本机回环地址，远程访问请使用 SSH 端口转发。

  • 每个接口都需要至少 32 字符的 Bearer Token，每台节点使用不同 Token。

  • 白名单命令不会接受任意 Shell 输入。

  • 如果监听局域网地址，必须额外使用 TLS 或可信加密网络并配置防火墙；Token 只能鉴权，不能加密明文 HTTP。