This tool holds credentials to a live website and a live database, so a vulnerability in it is a vulnerability in whatever it is pointed at. Reports are taken seriously.
- Supported versions
- Reporting a vulnerability
- What to expect
- What counts as a vulnerability here
- Known limitations
- Keeping your own deployment safe
Fixes go onto the latest release; older ones are not patched.
| Version | Supported |
|---|---|
| Latest release | Yes |
| Anything earlier | No |
Report privately, not in the public issue tracker.
Use GitHub's private vulnerability reporting on this repository. Please include what an attacker gains, the steps to reproduce it, and the version you tested — a proof of concept is welcome but never required.
Never include real credentials, hostnames or database contents in a report. A path and a description are enough.
A first reply within a week, and an honest answer about severity.
Confirmed issues are fixed and released, and the report is credited in the advisory unless you would rather it were not. If a report turns out not to be a vulnerability, you will be told why rather than left waiting.
Anything that lets a caller reach past the boundaries this tool claims to enforce.
| Class | Example |
|---|---|
| Path escape | A path that writes or deletes outside CDMON_FTP_ROOT |
| Write gate bypass | A change applied with CDMON_ALLOW_WRITES unset, or with dryRun true |
| Credential exposure | A password reaching a tool result, an error message or the audit log |
| Silent partial apply | SQL reported as successful when only some statements landed |
| Injection | Caller input reaching SQL or an FTP command in a way that changes its meaning |
These are design constraints, documented rather than fixed, and are not vulnerabilities.
- Symlinks are not resolved. FTP is remote, so there is no
realpath(). The path guard is lexical, and a symlink placed on the server can still lead somewhere unintended. - FTP without FTPS sends the password in the clear.
CDMON_FTP_SECURE=1if your plan accepts it. The default is off because not every plan does. - phpMyAdmin is a web session, not an API. Credentials are posted to a login form, and results are parsed out of HTML. See docs/phpmyadmin.md.
- The audit log is not tamper-proof. It is an append-only file with normal permissions, useful for reconstructing what happened, not for proving it to someone hostile.
Most of the risk is in configuration rather than code.
- Leave
CDMON_ALLOW_WRITESunset until a session actually needs to write, and unset it after. - Set
CDMON_FTP_ROOTto the narrowest directory that works — often the document root, not/. - Keep
.envout of version control. It is gitignored here, and CI fails if one is ever committed. - Use a database user with only the privileges the work needs.
- Read the audit log after an agent-driven session. That is what it is for.