If you discover a security vulnerability in opcuactl, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, please email security@otfabric.io with:

• A description of the vulnerability
• Steps to reproduce the issue
• The affected version(s) (opcuactl version output)
• Any potential impact you've identified

We will acknowledge your report within 48 hours and aim to provide a fix or mitigation within 7 days for critical issues.

opcuactl supports the full range of OPC UA security configurations. For production use:

• Always use encrypted connections (--security-mode SignAndEncrypt) when communicating over untrusted networks
• Use certificate-based authentication (--auth certificate) instead of username/password where possible
• --insecure-no-security is the only way to run without message security over opc.tcp, as a client and with serve. Use it only on an isolated, trusted network
• List the servers you trust with --trusted-cert: the system CA pool is not used, and a secure channel needs this list
• Do not use --insecure-skip-verify in production — it disables server certificate validation
• Size the limits of serve to the clients you expect with --max-sessions, --max-subscriptions and --max-subscriptions-per-session: a client can open sessions before it logs in, so the limits bound what an unauthenticated client can tie up

• Passwords provided via --password or OPCUACTL_PASSWORD are passed in memory and never logged
• Prefer environment variables over command-line flags for credentials, as command-line arguments may appear in process listings and shell history
• Certificate private keys (--key) should have restrictive file permissions (chmod 600)

• pubsub sks get-keys prints key material only with --show-keys; the keys it prints (and the --keys-file it is saved to) decrypt and forge the messages of the SecurityGroup until the keys rotate — treat them like a password (chmod 600, do not commit them)
• Prefer --security-group, which pulls keys from the Security Key Service when needed and keeps them in memory only
• MQTT broker passwords: prefer OPCUACTL_MQTT_PASSWORD over --mqtt-password

• opcuactl writes all data to stdout and all errors to stderr
• Be cautious when redirecting output to files in shared environments, as OPC UA node values may contain sensitive operational data