Security Operations 🟢

The security posture expected of every self-hosted RMM product.

Vulnerability disclosure

Found a security issue in any Rug Munch product? Do not open a public issue.

• Email: security@cryptorugmunch.com (PGP key published at cryptorugmunch.com/security)
• We acknowledge within 48 hours and aim for a fix or mitigation statement within 7 days.
• Coordinated disclosure is credited in release notes unless you decline.

Secrets

Rule	Enforcement
All credentials in a secret manager	gitleaks pre-commit + CI
No .env files in git	lefthook hook blocks them
Keys injected at container start	compose env_file from host-protected paths
Rotation schedule for all API keys	quarterly audit script

Transport & headers (production baseline)

• TLS 1.2+ only; Let's Encrypt with auto-renew
• HSTS (max-age=31536000; includeSubDomains)
• X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin
• Rate limiting on every public route

Supply chain

• Dependency updates via Renovate (patches auto-merge, majors manually reviewed)
• SBOM (CycloneDX via Syft) generated on every release
• Container images scanned (Trivy) blocking on CRITICAL/HIGH

What we never store

Private keys of user wallets (watch-only default), payment credentials, or anything we cannot delete on request.