Security

Security

ConvexAutoBackup is backup infrastructure. Treat it like production infrastructure even when it is running on a small VPS or homelab box.

Secrets

Treat these as sensitive:

• Convex deploy keys.
• CONVEX_AUTOBACKUP_MASTER_KEY.
• Docker Hub tokens.
• crates.io API tokens.
• GitHub tokens.
• S3/R2/B2/MinIO access keys.
• Backup archives and manifests for production deployments.

Do not paste secrets into issues, discussions, release notes, screenshots, logs, shell transcripts, or support requests.

Master key handling

CONVEX_AUTOBACKUP_MASTER_KEY protects encrypted app-managed secrets. Store it in your service manager, Docker secret system, or host secret manager.

Back it up securely. If you lose it, stored encrypted deploy keys or destination credentials may not be recoverable.

Network exposure

Default bind:

0.0.0.0:8976

This is useful for LAN/server installs but should not be treated as public-internet hardening. For production:

1. Put the service behind HTTPS.
2. Firewall direct access to the app port.
3. Use strong owner/admin passwords.
4. Use least-privilege API tokens.
5. Rotate credentials after staff or automation changes.

Roles

Expected role model:

Role	Purpose
Owner	Full control, users, destructive restore configuration.
Admin	Projects, targets, destinations, schedules, and tokens.
Operator	Run backups, verification, restore drills, and reports.
Viewer	Read health, runs, audit, and reports.

Authorization is enforced server-side. The UI is not the security boundary.

Restore safety

Restore requires explicit deployment confirmation. Keep restore access tighter than backup-read access because restore can overwrite live application state.

For drills, use a non-production Convex deployment.

GitHub security features

For the repository itself:

• Secret scanning should be enabled where available.
• Push protection should be enabled where available.
• Release secrets should live in GitHub Actions secrets, not workflow files.
• Tokens used for Docker Hub and crates.io should be scoped and rotated regularly.

Reporting vulnerabilities

Use a private channel when possible. If GitHub private vulnerability reporting is enabled, use the repository Security tab. Otherwise contact the maintainer before posting exploit details publicly.

Repository:

https://github.com/KodyDennon/ConvexAutoBackup