Security

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/pixlcore/xyops/llms.txt

Use this file to discover all available pages before exploring further.

The xyOps team takes security very seriously. Due to the nature of how xyOps is installed on large server fleets, security is always a priority, and we aim to implement security by design.

​

Coordinated Vulnerability Disclosure

xyOps follows the coordinated vulnerability disclosure model when dealing with security vulnerabilities. This was previously known as responsible disclosure.

​

Why Coordinated Disclosure?

This process helps ensure that:

• Users affected have an avenue to fix the issue as close to public disclosure as possible
• The attack surface is not increased via improved attacker knowledge
• Diligent administrators have time to patch before exploits become public

​

Reporting a Vulnerability

​

Contact Options

GitHub Security Advisories (Recommended)

Users can utilize GitHub’s security vulnerability system to privately report a vulnerability.Best for: Users who have a GitHub accountProcess:

1. Navigate to the security advisories page
2. Click “Report a vulnerability”
3. Fill in the details about the vulnerability
4. Submit the report

Email

Users can utilize the security@pixlcore.com email address to privately report a vulnerability.Best for: Users who do not have a GitHub accountAccess: This email account is only accessible by members of the core team for the purpose of disclosing security vulnerabilities and issues within the xyOps codebase.What to include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any proof-of-concept code (if applicable)
• Your contact information for follow-up

​

Disclosure Process

Here’s what happens when you report a security vulnerability:

​

Credit and Recognition

Users who report bugs will, at their discretion, be credited for the discovery. Where credit is given:

• In the security advisory
• In our documentation
• In release notes

​

Security Best Practices

When deploying xyOps, follow these security best practices:

​

Installation Security

Access Control

• Use strong passwords for all user accounts
• Enable multi-factor authentication where possible
• Limit administrator privileges to necessary users only
• Regularly review and audit user access

Network Security

• Use HTTPS/TLS for all web traffic
• Configure firewall rules to restrict access
• Use VPN or private networks for satellite connections
• Implement IP-based ACLs where appropriate

Secrets Management

• Store credentials in the Secrets vault
• Never hardcode passwords in plugins or scripts
• Rotate credentials regularly
• Use environment variables for sensitive configuration

​

Configuration Security

Web Server

• Enable HTTPS with valid TLS certificates
• Configure appropriate session timeouts
• Use secure cookie settings
• Implement rate limiting on API endpoints

Database

• Use external storage (S3, MinIO) for production
• Encrypt data at rest where possible
• Implement regular backups
• Restrict database access to localhost where possible

API Keys

• Use API keys instead of user credentials for automation
• Implement rate limiting on API keys
• Rotate API keys regularly
• Restrict API key privileges to minimum necessary

​

Plugin Security

Plugin Vetting

• Review plugin source code before installation
• Check plugin author reputation
• Verify plugin signatures where available
• Test plugins in a development environment first

Shell Plugin

The Shell Plugin script parameter is administrator-locked by default. This means:

• Only administrators can modify shell scripts
• Non-admin users can run pre-approved scripts
• This prevents privilege escalation via script modification

​

Monitoring and Auditing

Activity Logging

• Enable comprehensive activity logging
• Monitor for suspicious activity
• Review activity logs regularly
• Set up alerts for security-relevant events

Regular Updates

• Subscribe to security advisories
• Apply security patches promptly
• Test updates in development before production
• Maintain an update schedule

​

Security Features

xyOps includes several built-in security features:

​

Authentication

• User authentication with password hashing
• API key authentication for automation
• SSO/SAML integration support
• Session management with timeouts

​

Authorization

• Role-based access control (privileges)
• Category-based permissions
• Parameter-level locking (admin-only fields)
• API endpoint access control

​

Encryption

• TLS/HTTPS support for web traffic
• Encrypted WebSocket connections
• Secret vault for credential storage
• Secure cookie handling

​

Auditing

• Comprehensive activity logging
• User action tracking
• API access logging
• Job execution history

​

Common Security Questions

Should I run xyOps as root?

No. It’s recommended to run xyOps as a dedicated user with appropriate permissions. The installer sets up proper permissions automatically.

How should I handle database credentials?

Store all credentials in the Secrets vault and reference them via environment variables or params. Never hardcode credentials in plugins or configuration.

Can I use xyOps in a zero-trust environment?

Yes. xyOps supports:

• Mutual TLS authentication
• IP-based ACLs
• SSO integration
• API key authentication

Configure these features according to your security requirements.

How do I secure satellite communications?

• Use TLS for WebSocket connections
• Implement network segmentation
• Use VPNs or private networks
• Configure firewall rules to restrict access

​

Security Compliance

xyOps can be configured to meet various compliance requirements:

• Audit Logging: Comprehensive activity logs for compliance tracking
• Access Control: Granular permissions and role-based access
• Encryption: TLS/HTTPS support for data in transit
• Secrets Management: Secure vault for credential storage
• Regular Updates: Active maintenance and security patching

​

Additional Resources

• Security Advisories
• Governance Model
• Development Guide
• Contributing Guide

​

Contact

For security-related inquiries:

• Security vulnerabilities: security@pixlcore.com
• General security questions: GitHub Discussions
• Enterprise security consulting: Contact via xyops.io