# SECURITY_RULES.md

## Secrets

- Never commit `.env`.
- Never display tokens in logs, reports or screenshots.
- Use `.env.example` for variable names only.
- Use environment variables for runtime secrets.
- Rotate any secret that may have been exposed.

## Files And Permissions

- Restrict private key permissions.
- Keep SSH keys outside the repository.
- Keep secrets in a dedicated secret manager or protected environment file.
- Do not store tokens in task reports.

## SSH

- Use key-based auth.
- Disable password SSH on servers when possible.
- Use non-root users for deployments.

## Backups

- Use local and remote backups.
- Prefer `rclone` to a private remote.
- Test restore procedures.
- Do not backup raw secrets into broad shared storage.

## Telegram Bot Security

- Store `TELEGRAM_BOT_TOKEN` only in environment variables.
- Enforce `TELEGRAM_ALLOWED_USER_IDS`.
- Require confirmation for dangerous actions.
- Log commands without secrets.
- Rate limit actions.

## Remote Access

- Prefer Cloudflare Tunnel or Tailscale.
- Avoid direct port exposure unless necessary.
- Put authentication in front of dashboards.