Brook Admin is a self-hosted control plane for Brook VPN/proxy servers. It handles access tokens and operator credentials, so security is treated as a first-class concern.

Do NOT open a public GitHub issue for security vulnerabilities. Please report them privately so we can fix and coordinate disclosure before details are public.

To report privately, open a GitHub Security Advisory ("Report a vulnerability") on this repository, or email the maintainers directly with the details below.

Please include:

• Affected component and version (commit/tag).
• A minimal, reproducible description (steps, config, screenshots if helpful).
• Impact and any suggested fix, if known.

You should receive an acknowledgement within a few days. We will coordinate disclosure and credit reporters who follow responsible disclosure when a fix is released.

Key controls implemented:

• Sessions — server-side session IDs in HttpOnly/Secure/SameSite cookies; CSRF double-submit protection.
• Passwords — bcrypt hashed; bootstrap admin only created when none exists.
• Access tokens — SHA-256 hashes only; plaintext shown once, never stored.
• Secrets at rest — server credentials encrypted with AES-256-GCM.
• RBAC — super_admin / admin / support / viewer, enforced in the backend, never trusted from the client.
• Input guards — paramaterized SQL, validation, per-IP rate limits at the reverse proxy, security headers (CSP, HSTS, etc.).
• Secrets in deploy — all real credentials come from .env and are required (${VAR:?...}) in production; the example env files use change-me-* placeholders and are never committed.

See docs/security.md for the full threat model.

• Generate strong, unique SESSION_SECRET and ADMIN_CSRF_SECRET (openssl rand -hex 32).
• Use a strong POSTGRES_PASSWORD and BOOTSTRAP_ADMIN_PASSWORD.
• Serve only over HTTPS (Caddy automatic TLS in production).
• Do not commit .env; keep it in your server's secret store.
• Run the stack as a non-root user where possible and keep the OS patched.
• Review access to the agents and monitoring profiles.