stoat-admin/SECURITY.md

Security Policy

Security Model

Stoat Admin is designed to keep the application containers private even when the admin entrypoint is fronted by its own HTTPS proxy. The intended deployment model is:

• admin-proxy is the only published service and terminates HTTPS for the admin stack with Caddy's internal CA
• admin-web and admin-api are reachable only on the private admin container network
• admin-api joins the Stoat network only so it can reach MongoDB
• the dashboard is not exposed through the public Stoat reverse proxy
• the API still requires session-based authentication with an Argon2id-hashed admin credential

This means the reverse proxy limits what is exposed, the shared Stoat network is used only where needed, and the application session still limits user access.

Reporting

If you discover a security issue, avoid opening a public issue with exploit details. Share the report privately with the maintainer and include:

• affected version or commit
• reproduction steps
• impact
• any suggested mitigation

Deployment Notes

• Keep SESSION_SECRET and RESEND_API_KEY out of the repository.
• Restrict permissions on the SQLite database file mounted at /data/admin.db.
• Set ADMIN_WEB_ORIGIN precisely. Do not use *.
• Verify the compose port bindings expose only admin-proxy, not admin-web or admin-api.
• Trust Caddy's internal root CA only on the admin devices that should access the dashboard.
• Protect the admin_proxy_data volume. It contains the private CA material used to issue the dashboard certificate.