Security

Secrets

Do not commit real tokens, passwords, WARP+ keys, Telegram bot tokens, proxy secrets, backup passwords, or VPS credentials.

Runtime secrets live on server:

/root/pcatelegram_web-admin.password
/opt/pcatelegram_web/config.json
/opt/pcatelegram_web/warp.json
/opt/pcatelegram_web-bot/.env
/etc/telemt/config.toml

Important permissions:

auth file: 0600
WARP config: 0600
bot .env: 0600
telemt config: 0600

Web Admin

Default install uses admin / admin. Change it in web-admin Settings after first login.

Admin session cookie is HttpOnly, SameSite=Lax, and gains Secure when request comes through HTTPS reverse proxy via X-Forwarded-Proto: https or X-Forwarded-Ssl: on.

Write APIs require X-PCAtelegram-Web-Admin: 1 and JSON content type. Responses include security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Public Site On Port 80

Uploaded HTML is served publicly. Do not upload files with secrets, internal URLs, API tokens, private notes, or admin links.

Backups

Backups can include proxy keys, WARP config, bot state, SSL files, admin panel files, and traffic history. Use encrypted backups for transport or off-server storage.

Reporting

Report security issues privately to project owner. Do not open public issues with secrets or working exploit details.

1.4 KiB Raw Blame History