1.8 KiB
Security Policy
MiniGate touches gateway-facing features such as DDNS, ACME certificates, reverse proxy configuration, LuCI access, login-failure monitoring, and nftables bans. Please report security issues responsibly.
Supported Versions
Security fixes are targeted at the latest release published on GitHub Releases. Users should upgrade to the latest release before reporting issues that may already be fixed.
Reporting a Vulnerability
If you find a vulnerability, please do not publish exploit details in a public issue before it has been reviewed.
Report privately by email:
Please include:
- affected MiniGate version
- OpenWrt or ImmortalWrt version
- installation method, such as IPK, source install, or SDK build
- affected feature, such as DDNS, ACME, reverse proxy, login guard, or LuCI UI
- clear reproduction steps
- expected impact
I will try to acknowledge valid reports within 7 days and coordinate a fix or mitigation in a release when appropriate.
Scope
In scope:
- command injection or unsafe shell argument handling
- configuration injection in generated Nginx, ACME, DDNS, or nftables files
- authentication or authorization bypass in LuCI pages
- unsafe handling of API tokens, certificates, private keys, or ban records
- issues that weaken direct-IP or unknown-Host rejection behavior
Out of scope:
- vulnerabilities in upstream OpenWrt, ImmortalWrt, LuCI, Nginx, Cloudflare, or Let's Encrypt components
- reports that require compromised router root access as the only prerequisite
- denial-of-service reports without a realistic router-facing impact
Disclosure
Please allow time for investigation and patching before public disclosure. Once a fix is available, the release notes will mention the security-relevant change without exposing unnecessary exploit details.