Please do not open a public issue for a security problem. Use GitHub's private security advisory form on this repository, or email info@netcupgutscheine.com with:

• the affected script and version or commit;
• a minimal reproduction;
• the impact you observed;
• any suggested fix.

Do not include real Netcup API keys, customer numbers, passwords, or private server addresses in a report.

These scripts can change firewall, network, DNS, and kernel settings. Review every script before running it, test on a disposable server, and keep an out-of-band console available.

netcup-init.sh can install Docker. Docker publishes container ports through its own iptables rules and can bypass UFW. Review DOCKER-USER rules before exposing containers.

netcup-dns-sync.sh reads credentials from environment variables. It never writes them to disk or logs, but environment variables can be visible to privileged local users. Run it as a dedicated user where possible.

SCP REST tools use an OAuth2 refresh token. Treat it as a password: store it with mode 600 under ~/.config/netcup-toolbox/ or pass it through a secret manager, never in a repository, issue, screenshot, or CI log. Revoke a leaked token in the SCP account console and run the device flow again.