File size: 1,180 Bytes
80fa878 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 | # SECURITY_RULES.md
## Secrets
- Never commit `.env`.
- Never display tokens in logs, reports or screenshots.
- Use `.env.example` for variable names only.
- Use environment variables for runtime secrets.
- Rotate any secret that may have been exposed.
## Files And Permissions
- Restrict private key permissions.
- Keep SSH keys outside the repository.
- Keep secrets in a dedicated secret manager or protected environment file.
- Do not store tokens in task reports.
## SSH
- Use key-based auth.
- Disable password SSH on servers when possible.
- Use non-root users for deployments.
## Backups
- Use local and remote backups.
- Prefer `rclone` to a private remote.
- Test restore procedures.
- Do not backup raw secrets into broad shared storage.
## Telegram Bot Security
- Store `TELEGRAM_BOT_TOKEN` only in environment variables.
- Enforce `TELEGRAM_ALLOWED_USER_IDS`.
- Require confirmation for dangerous actions.
- Log commands without secrets.
- Rate limit actions.
## Remote Access
- Prefer Cloudflare Tunnel or Tailscale.
- Avoid direct port exposure unless necessary.
- Put authentication in front of dashboards.
|