-
Notifications
You must be signed in to change notification settings - Fork 0
Security
The hub is privileged infrastructure. Connections are owned per hub administrator. In the 0.10.0 release, an owner can explicitly share one connection with an existing hub account that has read access. Destination capabilities still apply to every request. Hidden controls are not the security boundary.
Connections require an administrator. Application Passwords are revocable but not scoped or expiring OAuth tokens. Fleet never receives the normal login password. Its dedicated credential is sodium-encrypted using keys derived from WordPress secret material; a compromised hub with those secrets can act on connected sites.
Pending approval lasts ten minutes, belongs to one user, and is consumed once. Server-side records control the destination. The callback checks state/nonce/origin, introspection, and capabilities; its response disables caching/referrers.
Core returns the password in the callback query string. Do not record full callback URLs in reverse-proxy logs, analytics, screenshots, or support reports. Configure infrastructure redaction. HTTPS/no-referrer cannot erase existing logs.
Repair verifies the new credential before replacing the old generation. Review old-password cleanup warnings. Disconnect revokes the exact UUID before local removal. Uninstall cannot guarantee remote revocation.
Production retains WordPress safe-HTTP/private-address protections and TLS validation. Authenticated requests stay within the connected origin; Explorer cannot select an arbitrary host. Timeouts and payload limits bound resource use.
Studio certificate/private-address/fault adapters are test-only and excluded from the ZIP.
Search copies limited metadata to a separate encrypted hub index. Notes/activity are private per hub user. Encryption at rest does not protect against complete hub compromise.
Fresh-read fingerprints include supported publishing metadata. Hub-local item locks serialize Fleet content writes, including delegated writers, but are not atomic remote locks against an editor elsewhere. A 14-day creation journal limits duplicate/uncertain replay; it cannot prove an interrupted destination request failed or guarantee exactly-once writes forever. Reviewed comment batches are capped at 12 items, have a 20-second execution budget and report conflicts, unattempted items and unknown outcomes separately. They are not transactions and do not automatically roll back.
Connections are private by default. Owners grant Reader, Editor or Operator access per site to existing hub accounts. Readers browse content, media and comments. Editors also edit content/media and moderate/reply to comments. Operators additionally manage supported settings, plugins and users. Explorer, connection credentials, sharing and private agency notes remain owner-only.
Every delegated action and remote HTTP send checks the live grant, recipient access, owner administrator capability and connection generation. Reauthorization invalidates previous grants. Revoking a grant blocks subsequent requests in an already-open window; it cannot cancel a remote write already accepted by WordPress. Privacy erasure removes grants with conflict-aware hub locks; Core account deletion also removes the recipient index.
These are hub workflow permissions, not scoped Application Passwords. WordPress sees the connection owner's approved remote account as the actor. A trusted Operator can create another remote administrator through Core, so grant that role accordingly. Fleet does not promise separate remote audit identities for teammates.
Editor recovery is opt-in. Core Heartbeat carries changed editor values to an encrypted, per-user hub transient store. At most ten checkpoints of 200 KB each are retained for seven days. Connection URL/generation, user, content type/item and editor request identity prevent cross-site or cross-user recovery. Sequence checks prevent older heartbeats overwriting newer text; saved/deleted checkpoints are retired against late heartbeats. No remote draft is created or published by recovery. Core transients may disappear early; this is best-effort crash recovery, not a backup or durable autosave guarantee. It covers the content editor, not every form in Fleet.
Uploads are limited to 2 MiB, sent through Core's media endpoint and checked against file-type and image-size bounds before transport. Remote WordPress performs its own capability/type checks. Application Passwords and binary upload bodies are never included in support reports.
Diagnostics use an allowlist of versions, flags, counts, and check state. No credentials, salts, cookies, URLs, site names, usernames, notes, content, or free-form remote errors are included. Nothing is submitted automatically.
Do not post sensitive security reports publicly. A private reporting channel and response owner must be confirmed before launch; see Launch checklist.