SECURITY_RULES.md

SECURITY_RULES.md

Secrets

• Never commit .env.
• Never display tokens in logs, reports or screenshots.
• Use .env.example for variable names only.
• Use environment variables for runtime secrets.
• Rotate any secret that may have been exposed.

Files And Permissions

• Restrict private key permissions.
• Keep SSH keys outside the repository.
• Keep secrets in a dedicated secret manager or protected environment file.
• Do not store tokens in task reports.

SSH

• Use key-based auth.
• Disable password SSH on servers when possible.
• Use non-root users for deployments.

Backups

• Use local and remote backups.
• Prefer rclone to a private remote.
• Test restore procedures.
• Do not backup raw secrets into broad shared storage.

Telegram Bot Security

• Store TELEGRAM_BOT_TOKEN only in environment variables.
• Enforce TELEGRAM_ALLOWED_USER_IDS.
• Require confirmation for dangerous actions.
• Log commands without secrets.
• Rate limit actions.

Remote Access

• Prefer Cloudflare Tunnel or Tailscale.
• Avoid direct port exposure unless necessary.
• Put authentication in front of dashboards.