Version 2.5.0

https://github.com/mr-r0ot/NoRootVpn-Panel/blob/main/SECURITY_UPDATE.md#v200-vulnerabilities-fixed-in-v250

Version 2.0.0

Security Update

The latest security update introduces several hardening measures across the project:

• Enhanced CSRF protection has been implemented across relevant state-changing requests.
• CAPTCHA protection has been added to the login flow to reduce automated login and brute-force attempts.
• Input validation and sanitization have been strengthened across configuration, web interfaces, and other externally controlled inputs, with particular attention to command-injection risks.
• The project contains no application logic that executes server commands directly from untrusted external input.
• The project does not use MySQL or an SQL database, so traditional direct SQL injection against a project database is not applicable.
• Digital signatures and integrity checks are used to validate supported downloaded binaries and ZIP packages before use.
• Compromising the administrative panel does not by itself provide shell access or arbitrary server command execution through the application.
• The project's .htaccess configuration has been hardened, including restrictions for sensitive directories such as bin and protections against unintended directory listing and direct file access.
• A dedicated SECURITY.md has been added with security reporting and disclosure guidelines.

These changes are part of the project's ongoing security hardening and do not constitute a guarantee that the software is completely vulnerability-free.

Version 1.0.1

first project