Please do not open public GitHub issues for security vulnerabilities.

Instead, email fortunnels@yandex.ru with details of the issue.

• Vulnerability type (e.g., XSS, SQL injection, etc.)
• Full path to the affected file
• Description of the issue
• Potential impact
• Steps to reproduce
• Suggested fix (if any)

1. We acknowledge receipt within 48 hours
2. We assess the issue and provide status within 7 days
3. We fix the vulnerability and ship a patch
4. We publish a security advisory after the fix

• All connections to the server use HTTPS (TLS 1.2+)
• Optional stream encryption (PSK) is supported
• XChaCha20-Poly1305 is used for stream encryption

• PSK is never written to disk
• Tokens and passwords can be provided via environment variables, files, or stdin
• Prefer environment variables, files, or stdin over CLI flags

1. Use long random PSKs:

   ./bin/client 8000 -encrypt -psk "$(openssl rand -hex 32)"

2. Store secrets in environment variables:

   export FORTUNNELS_TOKEN="your-token"
   export FORTUNNELS_PSK="your-psk"

3. Use files or stdin for secrets:

   ./bin/client 8000 -token-file ./token.txt -psk-stdin

4. Do not reuse a PSK across tunnels

5. Keep the client up to date to receive the latest security fixes

We thank everyone who responsibly reports security vulnerabilities.