-
Notifications
You must be signed in to change notification settings - Fork 0
Security
The hub is privileged infrastructure. Only administrators with manage_options use Fleet; connections are owned per hub user. Destination capabilities apply to every request. Hidden controls are not the security boundary.
Connections require an administrator. Application Passwords are revocable but not scoped or expiring OAuth tokens. Fleet never receives the normal login password. Its dedicated credential is sodium-encrypted using keys derived from WordPress secret material; a compromised hub with those secrets can act on connected sites.
Pending approval lasts ten minutes, belongs to one user, and is consumed once. Server-side records control the destination. The callback checks state/nonce/origin, introspection, and capabilities; its response disables caching/referrers.
Core returns the password in the callback query string. Do not record full callback URLs in reverse-proxy logs, analytics, screenshots, or support reports. Configure infrastructure redaction. HTTPS/no-referrer cannot erase existing logs.
Repair verifies the new credential before replacing the old generation. Review old-password cleanup warnings. Disconnect revokes the exact UUID before local removal. Uninstall cannot guarantee remote revocation.
Production retains WordPress safe-HTTP/private-address protections and TLS validation. Authenticated requests stay within the connected origin; Explorer cannot select an arbitrary host. Timeouts and payload limits bound resource use.
Studio certificate/private-address/fault adapters are test-only and excluded from the ZIP.
Search copies limited metadata to a separate encrypted hub index. Notes/activity are private per hub user. Encryption at rest does not protect against complete hub compromise.
Fresh-read fingerprints detect stale edits but are not atomic remote locks. A one-day creation marker limits duplicate/uncertain replay; it cannot prove an interrupted destination request failed. Unsaved content is not crash-proof autosave.
Diagnostics use an allowlist of versions, flags, counts, and check state. No credentials, salts, cookies, URLs, site names, usernames, notes, content, or free-form remote errors are included. Nothing is submitted automatically.
Do not post sensitive security reports publicly. A private reporting channel and response owner must be confirmed before launch; see Launch checklist.