Security

Security

Reporting a vulnerability

Report security issues privately. Do not open a public GitHub issue for a suspected vulnerability.

Contact: <security-contact> (replace with the project's disclosure address or a GitHub private security advisory link).

Include the affected version or commit, a description, and steps to reproduce. You will get an acknowledgement while the fix is worked.

Hardening checklist

The server fails to boot in production if the core hardening config is missing, so the core items are enforced at boot. The rest is up to the operator.

Secrets

• Set JWT_SIGNING_KEY, EMAIL_VERIFY_SIGNING_KEY, and METRICS_AUTH_TOKEN explicitly in production. Do not rely on the auto-generated keys, which live only in one database and are hard to rotate.
• Mount secrets with the <NAME>_FILE form rather than passing them inline where you can.
• Back up Postgres. It holds the server_secrets table, so losing it loses the signing keys.

Two-factor key

• TWO_FACTOR_ENC_KEY encrypts TOTP secrets at rest. Setting it pins the key so it is not tied to one database.
• Changing or removing it after players enroll locks those logins out until the prior key is restored. Rotate deliberately, and keep the old key as a decrypt fallback during a rotation.

TLS and cookies

• Terminate TLS in front of the server. The server itself speaks plain HTTP.
• In production set CONTROL_PANEL_COOKIE_SECURE=true and CONTROL_PANEL_BASE_URL on https://.

Least privilege

• Give each API key the narrowest scope that covers its job. Keep server-tier keys (fleet and server scopes) separate from client keys.
• Point DATABASE_URL at a least-privilege login role and use a separate DB_MIGRATE_URL for the migration role that runs DDL.

Network surface

• Set CORS_ALLOWED_ORIGINS to your real origins with no *.
• Only trust a forwarded-IP header from your own proxy: set TRUSTED_PROXY_HEADER together with TRUSTED_PROXY_CIDRS.
• Token-gate /metrics with METRICS_AUTH_TOKEN, or disable auth on it on purpose with METRICS_AUTH_DISABLED=true.
• If you enable the entitlement API (ENTITLEMENT_API_ENABLED), bind or firewall it to a private network. It is off by default.

See Configuration Reference for every variable named here.