# Security policy

## Reporting a vulnerability

**Please do not open a public issue for security problems.**

Email the maintainer at **`mail@kzbikowski.pl`** with the subject prefixed
`[ADconsole security]`. If the host offers private vulnerability reporting, that
channel is fine too.

Please include:

- affected version / commit
- a description and impact assessment
- reproduction steps or a proof of concept
- any suggested fix

You'll get an acknowledgement within a few working days. Please give a
reasonable window for a fix before public disclosure; we'll credit you in the
release notes unless you'd rather stay anonymous.

## Scope

In scope: authentication and the `AD_LOGIN_GROUP` gate, authorisation between
modules, LDAP query/filter construction (injection), handling of the service
account credentials, the attribute-encryption feature, session handling, CSRF,
XSS in the Blade views, privilege escalation via the bulk actions.

Out of scope: issues that require a already-privileged panel account performing
actions it is legitimately delegated to do in AD; missing hardening that is the
operator's responsibility (see below); vulnerabilities in Laravel, LdapRecord or
other dependencies (report those upstream — do tell us so we can pin/patch).

## Operator responsibilities

ADconsole is a privileged tool. When you deploy it, **you** are responsible for:

- Serving it over HTTPS only, reachable from admin networks / VPN only.
- `APP_DEBUG=false`, `APP_ENV=production`.
- An encrypted LDAP channel (`LDAP_SSL` / `LDAP_TLS`) and, ideally,
  `LDAP_TLS_VERIFY=true`.
- Delegating the service account **only** the AD rights you actually use
  ([active-directory.md](active-directory.md)).
- Keeping `AD_LOGIN_GROUP` small and audited.
- Protecting `.env` (file mode `600`) — it contains the service-account password.
- Applying updates promptly.

See the [hardening checklist](deployment.md#hardening-checklist).

## Supported versions

The latest release on `main` receives security fixes. This is a
community/self-hosted project with no long-term-support branches.