This project is a remote management platform. Review deployments as security-sensitive infrastructure.

Please do not disclose exploitable issues publicly before maintainers have had time to investigate. If this repository is mirrored to a public forge, use that forge's private vulnerability reporting channel when available.

• SERVER_ADMIN_TOKEN is intentionally empty by default; HTTP admin APIs fail closed until it is configured.
• SERVER_AGENT_SHARED_TOKEN is intentionally empty by default; new Agent bootstrap fails closed until it is configured or an Agent-specific token already exists in the database.
• Use wss behind TLS for production traffic.
• Rotate any credential that has ever been committed to Git history before making the repository public.

Security-relevant areas include:

• Agent and admin authentication.
• Plugin install, activation, configuration, and dependency lifecycle.
• Remote desktop input, clipboard, media, and session policy.
• File transfer sessions and path handling.
• Terminal and tunnel sessions.
• Bounded queues, cancellation, and lifecycle teardown.