| # SECURITY_RULES.md | |
| ## Secrets | |
| - Never commit `.env`. | |
| - Never display tokens in logs, reports or screenshots. | |
| - Use `.env.example` for variable names only. | |
| - Use environment variables for runtime secrets. | |
| - Rotate any secret that may have been exposed. | |
| ## Files And Permissions | |
| - Restrict private key permissions. | |
| - Keep SSH keys outside the repository. | |
| - Keep secrets in a dedicated secret manager or protected environment file. | |
| - Do not store tokens in task reports. | |
| ## SSH | |
| - Use key-based auth. | |
| - Disable password SSH on servers when possible. | |
| - Use non-root users for deployments. | |
| ## Backups | |
| - Use local and remote backups. | |
| - Prefer `rclone` to a private remote. | |
| - Test restore procedures. | |
| - Do not backup raw secrets into broad shared storage. | |
| ## Telegram Bot Security | |
| - Store `TELEGRAM_BOT_TOKEN` only in environment variables. | |
| - Enforce `TELEGRAM_ALLOWED_USER_IDS`. | |
| - Require confirmation for dangerous actions. | |
| - Log commands without secrets. | |
| - Rate limit actions. | |
| ## Remote Access | |
| - Prefer Cloudflare Tunnel or Tailscale. | |
| - Avoid direct port exposure unless necessary. | |
| - Put authentication in front of dashboards. | |