77 lines
2.3 KiB
Markdown
77 lines
2.3 KiB
Markdown
|
# Security Policy
|
||
|
|
|
||
|
|
## Supported Versions
|
||
|
|
|
||
|
|
Only the latest release of NixPanel receives security fixes.
|
||
|
|
|
||
|
|
| Version | Supported |
|
||
|
|
|---------|-----------|
|
||
|
|
| Latest stable | ✅ |
|
||
|
|
| Older releases | ❌ |
|
||
|
|
|
||
|
|
We strongly recommend always running the latest version. The installer is self-updating and will always pull the current release.
|
||
|
|
|
||
|
|
## Reporting a Vulnerability
|
||
|
|
|
||
|
|
**Please do not report security vulnerabilities through public GitHub issues.**
|
||
|
|
|
||
|
|
### Option 1 — GitHub Private Vulnerability Reporting (preferred)
|
||
|
|
|
||
|
|
Use GitHub's built-in private reporting:
|
||
|
|
[Report a vulnerability](https://github.com/NixReaper/nixpanel/security/advisories/new)
|
||
|
|
|
||
|
|
This keeps the report confidential until a fix is released.
|
||
|
|
|
||
|
|
### Option 2 — Email
|
||
|
|
|
||
|
|
Send details to **[email protected]**
|
||
|
|
|
||
|
|
Include:
|
||
|
|
- A description of the vulnerability
|
||
|
|
- Steps to reproduce
|
||
|
|
- Affected versions
|
||
|
|
- Any proof-of-concept code (if available)
|
||
|
|
|
||
|
|
We will acknowledge your report within **48 hours** and aim to release a fix within **14 days** for critical issues.
|
||
|
|
|
||
|
|
## Scope
|
||
|
|
|
||
|
|
Issues we consider in-scope:
|
||
|
|
|
||
|
|
- Remote code execution
|
||
|
|
- Privilege escalation
|
||
|
|
- Authentication bypass
|
||
|
|
- SQL injection
|
||
|
|
- Sensitive data exposure (credentials, license keys, private keys)
|
||
|
|
- Cross-site scripting (XSS) in the control panel UI
|
||
|
|
- Server-side request forgery (SSRF)
|
||
|
|
|
||
|
|
Out of scope:
|
||
|
|
|
||
|
|
- Vulnerabilities in software NixPanel installs but does not control (Apache, MariaDB, PHP, etc.) — report those to the respective upstream projects
|
||
|
|
- Issues requiring physical access to the server
|
||
|
|
- Social engineering attacks
|
||
|
|
|
||
|
|
## Security Best Practices
|
||
|
|
|
||
|
|
After installing NixPanel:
|
||
|
|
|
||
|
|
1. **Run certbot immediately** — never leave the panel on plain HTTP in production
|
||
|
|
```bash
|
||
|
|
certbot --apache
|
||
|
|
```
|
||
|
|
2. **Restrict panel ports** — firewall ports 2083 and 2087 to trusted IPs only
|
||
|
|
3. **Keep the system updated** — `apt upgrade` regularly
|
||
|
|
4. **Use strong admin passwords** — the panel enforces Argon2id hashing
|
||
|
|
5. **Monitor logs** — `journalctl -u nixpanel -f` and `/var/log/nixpanel/`
|
||
|
|
|
||
|
|
## Disclosure Policy
|
||
|
|
|
||
|
|
We follow **coordinated disclosure**. We ask that you:
|
||
|
|
|
||
|
|
- Give us reasonable time to fix the issue before public disclosure
|
||
|
|
- Not access or modify other users' data during testing
|
||
|
|
- Not perform denial-of-service testing
|
||
|
|
|
||
|
|
We will credit researchers in release notes unless you prefer to remain anonymous.
|