Thank you for helping keep Cipi and its users safe. We take security reports seriously and appreciate responsible disclosure.

Security fixes are provided for the latest stable release of Cipi. Older versions may receive backports at our discretion when the fix is practical and the issue is severe.

Check your installed version with:

cipi --version

Please do not open a public GitHub issue for security vulnerabilities.

Instead, use one of the following channels:

1. Open the Security tab of this repository.
2. Click Report a vulnerability.
3. Submit a private report with the details below.

This keeps the issue confidential until a fix is available.

We aim to acknowledge reports within an initial assessment within 60 days.

A helpful report usually contains:

• A clear description of the vulnerability and its impact
• Steps to reproduce, including Cipi version (cipi --version) and Ubuntu version
• Proof of concept or exploit details (if available)
• Affected components (CLI, REST API, GUI, deploy webhooks, MCP agent, etc.)
• Your contact information for follow-up

Please limit testing to systems you own or have explicit permission to test.

The following are in scope for this repository:

• The Cipi installer and core CLI (setup.sh, /opt/cipi, shell libraries)
• Generated server configuration (Nginx, PHP-FPM, MariaDB, Supervisor, cron, sudoers)
• Built-in REST API (cipi api) and authentication/authorization
• Deploy webhooks, Git integration, and backup/sync tooling shipped with Cipi
• Security-sensitive defaults and isolation between apps on a Cipi-managed server

Related projects maintained under cipi-sh may have their own SECURITY.md files:

• cipi/gui — optional web control panel
• cipi/cli — standalone API client
• cipi/whmcs — WHMCS provisioning module

If you are unsure where a report belongs, submit it here and we will route it to the right maintainers.

The following are generally out of scope unless they demonstrate a flaw in Cipi itself:

• Vulnerabilities in third-party software installed on the server (Nginx, PHP, MariaDB, Ubuntu, etc.) — report those upstream
• Misconfigurations on a specific VPS (weak passwords, exposed SSH keys, disabled firewall)
• Social engineering or physical access attacks
• Denial-of-service attacks without a demonstrated root cause in Cipi
• Issues in user-deployed application code (Laravel apps, WordPress, etc.) hosted on Cipi

• We will work with you to understand and validate the report.
• We will notify you when a fix is released or if we need more time.
• We ask that you do not publicly disclose the issue until we have published a fix or agreed on a disclosure timeline.
• We credit reporters in the release notes when a fix ships, unless you prefer to remain anonymous.

If you run Cipi in production:

• Keep Cipi updated: cipi self-update
• Configure SMTP notifications: cipi smtp configure
• Restrict API access with scoped tokens: cipi api token create
• Review the documentation for hardening and isolation details

Thank you for contributing to a safer Cipi ecosystem.