# Security Policy

## Supported Deployment

The supported production deployment is the canonical single-container instance on port `1216`.

AppOps is designed for trusted homelab/LAN operation behind network controls such as VPN, reverse-proxy authentication or trusted internal access. Do not expose the gateway directly to the public internet.

## No-Secrets Policy

- Do not commit API keys, tokens, passwords, cookies, private keys or production database files.
- Do not paste raw secrets into issues, changelogs, AI prompts, logs or screenshots.
- Connector secrets must be stored through encrypted secret storage or environment/key-file configuration.
- API responses and UI surfaces must show only write-only state such as `hasSecret`, `missing`, `secretRef` or redacted metadata.
- Backups may contain encrypted local state. Protect `/data`, `/data/backups` and the `APPOPS_SECRET_KEY` or `APPOPS_SECRET_KEY_FILE` together.

## Local-First Data Warning

AppOps stores operational state locally in SQLite under `/data/appops.db`. This can include encrypted connector secrets, audit events, inventory metadata, notification events and operator decisions.

SQLite online backups are written to `/data/backups`. They can be integrity-checked and downloaded from Settings, so treat downloaded copies as sensitive local state even though connector secrets remain encrypted. Restore is a stop-container/manual operation in V1. Losing the secret key means encrypted connector secrets in a restored database cannot be decrypted.

## Exposure Guidance

- Keep AppOps behind trusted LAN/VPN/reverse-proxy auth.
- Use TLS at the reverse proxy if accessing outside localhost/LAN.
- Do not mount `/var/run/docker.sock`.
- Do not run the container privileged.
- Do not use host networking for the default deployment.
- Keep destructive actions such as delete, prune, format and secret-show blocked unless a future reviewed policy/approval/audit/rollback design is implemented.
- Enrollment accepts only the reviewed `EnrollmentPlanV1` profiles. It cannot
  claim an existing container, hostname, Authentik application, appdata path or
  controller target, and it never accepts arbitrary Compose, callbacks,
  environment values or controller commands.
- Automatic production delivery accepts only an HMAC-verified Gitea main push
  after the controller has independently read the configured exact-SHA,
  push-only validation contexts with its root-owned read credential. Webhook
  payloads, Actions jobs and UI clients cannot claim validation success or
  supply the credential; Gitea API outages fail closed.

## Reporting

Report suspected security issues privately to the project owner/operator. Include the affected route, version, deployment context and redacted reproduction steps. Never include raw secrets in the report.