Security
Security model
Credential handling, authorization and operational safeguards.
Trust model
Portivo is an administrative tool intended for trusted management networks. Its security controls assume the host and management path are protected appropriately for privileged network operations.
Application controls
- Application secret must not remain the placeholder value.
- Personal SSH passwords are session-only.
- Monitoring, scheduler and webhook secrets are encrypted at rest.
- Login throttling is enabled by default.
- Role, capability, exact-action and scope checks are server enforced.
- Jobs and Audit Log preserve operational evidence.
- Runbooks have explicit approval and execution limits.
- 2.0.0 disables public API documentation and minimizes public health metadata.
- 2.0.0 checks terminal WebSocket Origin, blocks webhook redirects and bounds import processing.
Operational safety
- Exact command preview before execution.
- Dry-run/simulation where applicable.
- Strict per-device operation queues.
- Explicit pending-configuration tracking.
- Grouped persistent saves.
- Protected-port logic for sensitive maintenance workflows.
Source-backed detail
Security controls by trust boundary
- Browser boundary: signed session cookies, progressive login throttling and explicit HTTPS scheme handling.
- Identity boundary: local bootstrap administration plus personal SSH-backed sessions.
- Authorization boundary: backend-enforced capabilities and Site/Group scope.
- Credential boundary: session-only personal SSH passwords and separately encrypted unattended credentials.
- Execution boundary: exact preview, parameter validation, per-device FIFO coordination and immutable Job evidence.
- Network boundary: trusted management-network deployment and explicit proxy trust.
Security depends on deployment choices. Portivo does not turn direct public exposure of the application port into a safe Internet-facing architecture.