Do not publish exploitable details, credentials, proxy links, QR codes, private keys, certificates, node identities, or production configuration in an issue. Use GitHub's private vulnerability reporting if enabled; otherwise contact the maintainer through the security contact on the repository profile. Include a minimal sanitized reproducer, affected revision and impact.

• Public listeners: host Nginx remains the owner of shared TCP/443. Proxy runtimes bind only documented loopback/dedicated ports. Validate nginx -t and every adjacent SNI route.
• Panel/RBAC: expose the loopback panel only through an operator-controlled HTTPS boundary. Argon2id passwords, opaque sessions, CSRF, trusted hosts, roles and secret-free audit constrain the UI; do not treat them as a substitute for host access control.
• Telemt: configuration and quota state are persistent in the credential-bearing telemt-config named volume. Its bearer-authenticated API is reachable only on the private Compose network and is used by the panel; it is not disabled and must never be host-published.
• Naive/Caddy: the token-authenticated manager Unix socket is the mutation boundary. Caddy completion logs can contain usernames and traffic metadata; protect log rotations and SQLite/WAL state. Counters exclude TLS/IP and unfinished tunnels.
• Mieru/mita: the separately supplied GPL runtime is gated by exact executable digest/version and local UDS permissions. The manager is not a sandbox. Preserve state, authenticated journal and key as one generation; unknown state fails closed. Metrics remain degraded rather than guessed.
• Fleet v2 (linked panels): the central calls a node's own HTTPS panel domain with a scoped Bearer API key (node-sync); keys are SHA-256-hashed at rest, shown once, rate-limited (120/min) and revoked immediately; TLS is WebPKI or an explicit certificate pin, never skipped; the node accepts only typed, digested generation documents from one master GUID and exposes no shell, URL, method/path or config surface; the node's key is stored encrypted on the central and the node holds no credential of the central. A compromised central reaches every node it manages; a compromised node learns nothing about the others. See FLEET.en.md.
• Retired Fleet v1 state: pre-existing mTLS keys, node journals, database writer and the fleet-agent-data volume must be backed up and explicitly migrated to Fleet v2. The native panel update refuses installed Fleet v1 systemd units, configured/on-disk overlays and Fleet v1 containers in either historical Compose project, even stopped ones, before mutating files or database. Do not treat their absence from a new release as permission to remove installed keys or data.
• Host mutation: installer operations are owned, journaled, validated and reversible. Foreign drift, ambiguous Nginx maps, occupied ports and incomplete rollback stop further mutation.

Protect secrets/, complete access URLs, TLS/PKI keys, API keys (pc_…) and API/manager tokens, panel and accounting databases, telemt-config, Mieru journal keys, fleet outboxes and ownership manifests. Use mode-restricted storage and encrypted/access-controlled backups. Back up SQLite with WAL/SHM safely and restore manager state as complete generations. Never put these values in Git, CI output, screenshots or public logs.

Treat image digest, Caddy module/build, Telemt and mita changes as security changes. Verify provenance, upstream licenses, checksums already documented by the project, configuration render, least-privilege identity, negative authorization tests, rollback and real protocol behavior. A healthy container alone is insufficient.

The repository maintains test, Compose, image, dependency-audit and disposable-host lifecycle gates; see VALIDATION.md. A gate definition or an earlier successful protocol probe does not establish that a new revision passed it. Release evidence must identify the tested archive digest, host tier, results and skipped checks. Supported deployments use the release installer and Compose/Telemt path; the former host/systemd MTProxy installer has been removed.