GodMode is a self-hosted Control Center. Treat every deployment as trusted-operator infrastructure unless you harden it deliberately.

Do not open public GitHub issues for security vulnerabilities.

Use GitHub private security advisories for the public core repository.

Include: affected version, deployment mode (local / hub / client), reproduction steps, and impact assessment.

Full threat model and hardening steps: docs/SECURITY.md

Minimum before exposing Bridge to a network:

1. DEPLOYMENT_MODE=hub or client — never local on a public host
2. AUTH_ALLOW_ANONYMOUS=false
3. Strong AUTH_SESSION_SECRET
4. AUTH_ALLOW_SIGNUP=false or AUTH_INVITE_CODES on public hubs
5. CORS locked to your WEB_ORIGIN
6. Install plugins only from sources you trust
7. Run npm run audit:kernel:strict; production durable mutations must have zero legacy routes/callers, unmatched callers, and direct entry-point writes

Full threat model and hardening: docs/SECURITY.md