This project places a full-access BinaryLane API token behind a customer-managed gateway. A gateway compromise can therefore compromise the associated account. It has not received an independent security audit.
Before deployment:
- inspect the scripts, images, routes, and role mappings;
- use a dedicated, patched VPS and limit inbound access;
- use HTTPS for any internet-reachable deployment;
- confirm ports 9080, 9180, and 2379 are not externally reachable;
- use only generated user secrets and short-lived JWTs; and
- test every role against a non-production account or disposable resources.
Do not submit secrets in an issue. If you find a vulnerability, contact the repository owner privately through their GitHub profile. Rotate any potentially affected BinaryLane API token and JWT signing secrets immediately.