gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-10 10:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: harden public docs by removing security-sensitive details (#331)

Browse Source 
* docs: remove security-sensitive implementation details from public documentation

Generalize or remove internal architecture details that could aid targeted
attacks — CVE tables, database schema, rate limit thresholds, proxy internals,
encryption algorithm names, and WebSocket middleware bypass info.

* test(metrics): fix flaky minute-bucket aggregation test

Floor baseTime to the start of the current minute so baseTime + 5000
never crosses a minute boundary and produces 2 buckets instead of 1.
This commit is contained in:
Anso
2026-04-01 23:48:49 -04:00
committed by GitHub
parent 7d9dcc77d4
commit c4e2595ded
7 changed files with 28 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/multi-node.mdx
+3 -3
View File
@@ -81,11 +81,11 @@ Click the **pencil icon** on any remote node row to edit its name, URL, or token
### Token security
Node tokens are JWTs with a default **1-year expiry** that grant full control over the remote Sencho instance. Treat them like passwords:
Node tokens are JWTs with a configurable expiry that grant full control over the remote Sencho instance. Treat them like passwords:
- **Rotate immediately** if a token is compromised: Settings → Nodes → Generate Token on the remote instance. The old token is invalidated instantly.
- Tokens **expire after 1 year** by default. Generate a new token on the remote instance to renew access.
- Tokens are **encrypted at rest** using AES-256-GCM in Sencho's SQLite database. Even if the database file is extracted, the tokens cannot be read without the instance's encryption key.
- Tokens have a configurable expiry. Generate a new token on the remote instance to renew access.
- Tokens are **encrypted at rest** in Sencho's database. Even if the database file is extracted, the tokens cannot be read without the instance's encryption key.
- Tokens are scoped to `node_proxy` — they cannot access the host console or container exec terminals. Interactive shell access always requires a real browser session on that specific instance.
### Transport encryption