Please do not report security vulnerabilities through public GitHub issues.

Open a private vulnerability report on GitHub (Security → Report a vulnerability) or contact the project maintainers directly with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

You will receive a response within 48 hours.

Once confirmed, a fix will be released as soon as possible and you will be credited in the changelog unless you prefer to remain anonymous.

When running the control plane:

• Expose it only on a trusted network (e.g. the management VPN). The control plane is intentionally unauthenticated — protect it with a firewall.
• Keep the router subnet restriction enabled (CP_VPN_SUBNET, default 10.100.0.0/24) so clients cannot point the control plane at arbitrary hosts.
• Store router credentials only in the request body sent to the control plane — never hardcode them in clients.
• Use API-SSL (port 8729, "tls": true) in production environments.
• Restrict API access by IP in RouterOS: IP → Services → api → Available From
• Add TLS in front of the control plane (reverse proxy, e.g. Caddy/nginx) when it is reachable over the internet.

/user/group/add name=api-readonly policy=read,api,!write,!policy,!test,!winbox,!web,!ftp,!ssh,!telnet
/user/add name=control-plane group=api-readonly password=strongpassword