Files

T

NixReaper 776d328ace security: add SECURITY.md policy and enable GitHub security features

- SECURITY.md: reporting instructions (private advisory + email),
  scope, disclosure policy, post-install hardening tips
- Enabled via API: Dependabot alerts, private vulnerability reporting

2026-04-25 05:17:11 -05:00

2.3 KiB

Raw Permalink Blame History

Security Policy

Supported Versions

Only the latest release of NixPanel receives security fixes.

Version	Supported
Latest stable	✅
Older releases	❌

We strongly recommend always running the latest version. The installer is self-updating and will always pull the current release.

Reporting a Vulnerability

Please do not report security vulnerabilities through public GitHub issues.

Option 1 — GitHub Private Vulnerability Reporting (preferred)

Use GitHub's built-in private reporting:
Report a vulnerability

This keeps the report confidential until a fix is released.

Option 2 — Email

Send details to [email protected]

Include:

A description of the vulnerability
Steps to reproduce
Affected versions
Any proof-of-concept code (if available)

We will acknowledge your report within 48 hours and aim to release a fix within 14 days for critical issues.

Scope

Issues we consider in-scope:

Remote code execution
Privilege escalation
Authentication bypass
SQL injection
Sensitive data exposure (credentials, license keys, private keys)
Cross-site scripting (XSS) in the control panel UI
Server-side request forgery (SSRF)

Out of scope:

Vulnerabilities in software NixPanel installs but does not control (Apache, MariaDB, PHP, etc.) — report those to the respective upstream projects
Issues requiring physical access to the server
Social engineering attacks

Security Best Practices

After installing NixPanel:

Run certbot immediately — never leave the panel on plain HTTP in production
```
certbot --apache
```
Restrict panel ports — firewall ports 2083 and 2087 to trusted IPs only
Keep the system updated — apt upgrade regularly
Use strong admin passwords — the panel enforces Argon2id hashing
Monitor logs — journalctl -u nixpanel -f and /var/log/nixpanel/

Disclosure Policy

We follow coordinated disclosure. We ask that you:

Give us reasonable time to fix the issue before public disclosure
Not access or modify other users' data during testing
Not perform denial-of-service testing

We will credit researchers in release notes unless you prefer to remain anonymous.

2.3 KiB Raw Permalink Blame History