# Security Policy

## Supported Use

NTerminal is supported as a single-owner personal web terminal for localhost, private machines, private VPNs, SSH tunnels, or HTTPS reverse proxies with a real access boundary.

NTerminal is not currently supported as:

- a public internet shell service
- a hosted multi-user product
- a shared team terminal
- a replacement for SSO, OAuth, RBAC, or hardened bastion access

If you expose NTerminal outside localhost or a private network, put it behind HTTPS and a separate access-control layer before relying on it.

## Reporting Vulnerabilities

Do not post exploit details, host access details, secrets, or proof-of-compromise material in a public issue.

Preferred reporting path:

1. Use GitHub private vulnerability reporting if it is enabled for the repository.
2. If private reporting is not enabled, open a minimal public issue asking for a private contact path. Do not include sensitive details in that issue.

Please include:

- affected version or commit
- deployment shape, such as localhost, VPN, or reverse proxy
- reproduction steps
- expected impact
- whether real host shell access, session cookies, stored state, or PTY lifecycle is involved

## Security Boundary

NTerminal opens a real shell on the host account running the server. A vulnerability can therefore affect the host machine, not only the browser UI.

The intended defense-in-depth layers are:

- bind to `127.0.0.1` by default
- keep remote access behind VPN, SSH tunnel, or reverse proxy access control
- use HTTPS with `NTERMINAL_COOKIE_SECURE=true` when remote
- set precise `NTERMINAL_ALLOWED_ORIGINS`
- require TOTP two-factor at login (set up during first-run after the password)
- single active session: a new login or re-auth revokes the previous session
- sessions are bound to the client IP; a session presented from a different,
  non-whitelisted IP is rejected and must re-authenticate
- trusted devices may re-authenticate with a TOTP code only (no password) for 30 days
- trusted networks (exact IPs or CIDRs) skip the re-auth prompt
- keep `.env`, `.nterminal/`, logs, and state files out of source control

### Session IP binding behind a proxy

Session IP binding needs the real client IP. Behind a reverse proxy, set
`NTERMINAL_TRUST_PROXY` so NTerminal reads `X-Forwarded-For`. Only enable this when a
proxy you control sits in front of NTerminal — if the server is directly reachable,
a client can spoof `X-Forwarded-For` and defeat IP binding.

## Out Of Scope For Current Reports

The following are known product limitations unless they bypass the documented boundary:

- no multi-user roles
- no public internet hardening
- no terminal recovery after an OS reboot
- no Node-restart PTY persistence on hosts without `tmux`
- no container isolation for spawned shells
