Security and operator safety are critical priorities for hashem-panel. This document describes the project's vulnerability reporting procedure, supported releases, and security hardening architecture.

Only the latest release receives active security patches.

If you discover a security vulnerability in hashem-panel, please report it responsibly:

1. Do not create a public GitHub issue.
2. Send an email to the security maintainers with a detailed description, reproduction steps, and proof-of-concept (PoC) at:
   • security@pdnc.zone or open a private GitHub Security Advisory.
3. You will receive an acknowledgment within 48 hours.
4. Security patches will be issued within 7 days of confirmation.

• Mitigation: Plaintext passwords are never stored on disk. Passwords are only stored as salted argon2id hashes (legacy unsalted SHA-256 hashes are upgraded on next login) inside /etc/gre-panel/panel.json.
• Legacy panel.pass files are automatically removed during startup migration.
• Disaster recovery of admin credentials is provided exclusively via the ephemeral environment variable GRE_PANEL_PASSWORD.
• Backup archives use an independent, cryptographically generated 32-byte key (/etc/gre-panel/backup.key, mode 0600) rather than user passwords.

• Mitigation: Prebuilt panel updates and script updates are strictly pinned to official GitHub domains (github.com, raw.githubusercontent.com, api.github.com).
• Untrusted third-party mirrors (such as ghfast.top) have been completely removed.
• Binary downloads verify SHA-256 checksums from official release manifests (checksums.txt / SHA256SUMS) before installation.
• ELF header verification rejects HTML error redirects or corrupt files.
• Automatic rollback is executed if new binary installation encounters an error.

• Mitigation: Client IP evaluation defaults strictly to RemoteAddr.
• Headers such as X-Forwarded-For and X-Real-IP are only evaluated when the immediate socket connection originates from a verified reverse proxy configured via the TRUSTED_PROXY_IPS environment variable.
• Brute-force rate limiting and lockout mechanisms cannot be bypassed by forging forwarding headers.

• Mitigation: State-changing endpoints (POST, PUT, PATCH, DELETE) require a cryptographically valid X-CSRF-Token header.
• CSRF tokens are derived using HMAC-SHA256 bound to the authenticated session.
• Session cookies (gre_session) are issued with HttpOnly, SameSite=Lax, and Secure flags when running over HTTPS or trusted TLS reverse proxies.

• Mitigation: Changing the panel password requires verification of the current_password via constant-time comparison.
• Password change automatically invalidates all existing sessions (dropAllSessions), preventing hijacked sessions from persisting.

• Mitigation: Installer scripts (hashem.sh) downloaded from the repository must pass:
  1. Size and shebang integrity validation (#!/bin/bash or #!/usr/bin/env bash).
  2. Non-execution syntax verification (bash -n).
  3. Domain origin verification.
• Failed script synchronization does not disrupt running daemon operations.

• Mitigation: Interactive terminal access is disabled by default and requires explicit administrator enablement (TerminalEnabled: false).
• Single concurrent session enforcement with 10-minute idle disconnect and 30-minute absolute lifetime caps.
• WebSocket upgrades enforce same-origin checks.
• Connect, disconnect, and redacted command execution events are logged to tamper-evident security audit logs (/etc/gre-panel/security-audit.log).
• Connecting terminals present an immediate security notice banner informing the operator that sessions are audited.

• Mitigation: Passwords must be at least 12 characters long and must contain at least:
  • 1 uppercase letter (A-Z)
  • 1 lowercase letter (a-z)
  • 1 number (0-9)
  • 1 symbol (!@#$%^&*()-_=+[]{}|;:,.<>?/~'"`)
• Common and easily guessable passwords are systematically rejected by dictionary filtering.
• Client-side interface includes real-time password strength validation.