enuxia-frappe-aio/SECURITY.md

Security Policy

Project status

Enuxia Frappe AIO is a technical preview. It has not received a formal independent security audit and must not be treated as a complete production backup or disaster-recovery solution.

Reporting a vulnerability

Do not open a public issue for a suspected vulnerability.

Use a private communication channel with the Enuxia organization maintainers on the Gitea instance. Include the affected commit, reproduction steps, impact, and any proposed mitigation.

Security boundaries

Controller

The controller must not:

• access the Docker socket;
• execute system commands;
• read the agent SQLite database directly;
• expose privileged operations outside the typed protocol.

Agent

The agent is privileged because it can access Docker. It must:

• remain local;
• expose only allow-listed typed operations;
• use a mode 0600 Unix socket;
• validate every identifier and bound;
• avoid arbitrary command execution;
• keep responses bounded;
• persist state-changing operations safely.

Operational guidance

• Restrict access to the agent socket.
• Do not bind the agent protocol to TCP.
• Protect the SQLite state database.
• Use off-site backups.
• Test restoration on disposable infrastructure.
• Do not rely solely on checksum verification.
• Review configuration before exposing the web interface beyond localhost.