myOps holds the SSH credentials of every machine it manages and runs privileged commands on them. A bug here is not a bug in a dashboard - it is a bug in something that can reach a whole fleet as root. Please treat findings accordingly.

Do not open a public issue. Report privately instead:

• Preferred: GitHub private vulnerability reporting (Security tab → Report a vulnerability), which keeps the discussion out of public view until a fix ships.
• Or email letienhuy.dev@gmail.com with myOps security in the subject.

Useful things to include: what an attacker gains, the version or commit you tested, and the smallest sequence of steps that reproduces it. A proof of concept helps, but a clear description of the flaw is worth more than a working exploit.

You can expect an acknowledgement within 7 days. Once a fix is released the advisory is published, and you will be credited unless you would rather not be.

In scope - the parts that protect the fleet:

• Escaping the shell quoting in q() / sudoCommand(), or any path where a user-supplied value reaches a root command unquoted
• Recovering a stored secret: SSH credentials, sudo passwords, SMTP and Telegram settings, backup repository passwords, or the VAPID private key
• Bypassing authentication or session handling, or reaching an endpoint without a valid session
• Leaking a secret through an API response, a log line, a job log, or an error detail
• Privilege escalation on a managed machine beyond what the configured login already allows

Out of scope - known and documented properties, not vulnerabilities:

• MYOPS_MASTER_KEY decrypts every stored credential. Anyone who can read the environment or the database file of the myOps host has the fleet. That is the design; protect the host.
• The login user's PATH is appended to root commands so Homebrew, nvm and Docker Desktop stay reachable. This is documented as an accepted risk in conventions.md: the login user is already an account myOps escalates through, so it grants nothing they did not have.
• Anything that requires an attacker to already be root on the myOps host, or to already hold the master password.
• Missing hardening headers or rate limits on endpoints behind the session middleware, unless you can chain them into one of the in-scope items.

myOps is meant to run on a host you control, reachable only by people you trust, behind HTTPS. It is not hardened for exposure to the open internet as a multi-tenant service, and it does not try to be. Please keep that in mind when judging whether a finding is a vulnerability or a deployment choice.