We actively maintain security fixes for the following versions:

Please do NOT open a public GitHub issue for security vulnerabilities.

If you discover a security vulnerability, please report it responsibly by emailing:

📧 tarek.it.eng@gmail.com

Include the following in your report:

• Description of the vulnerability
• Steps to reproduce (proof of concept if possible)
• Affected versions
• Potential impact
• Suggested fix (optional)

We ask that you keep the vulnerability confidential until we have released a fix.

When deploying Jasmin Web Panel, follow these guidelines:

• Never commit .env files to version control.
• Set a strong, unique SECRET_KEY (at least 50 random characters).
• Always set DEBUG=False in production.
• Restrict ALLOWED_HOSTS to your actual domain(s).

• Change default credentials (admin / secret) immediately after first login.
• Use strong passwords for all accounts.
• Rotate Jasmin telnet credentials (TELNET_USERNAME, TELNET_PW) regularly.

• Run behind a reverse proxy (Nginx/Caddy) with TLS/SSL enabled.
• Restrict access to the Jasmin telnet port (default: 8990) to trusted hosts only.
• Use firewall rules to limit exposure of administrative ports.

• Use a dedicated database user with minimum required privileges.
• Enable SSL for database connections in production.

• Keep the application and all dependencies up to date.
• Monitor GitHub Security Advisories for this repository.

• The Jasmin telnet protocol transmits credentials in plaintext. Ensure the telnet interface is only accessible over a trusted internal network.
• The SECRET_KEY in sample.env is for development only. Always override it in production.

Thank you for helping keep Jasmin Web Panel secure! 🔒