CivICS is meant for closed ICS networks. Treat dest hashes, hub cards, volume contents, and operator-console access as sensitive.

Do not open a public GitHub issue for a security defect.

1. Use GitHub private vulnerability reporting if it is enabled on this repository, or
2. Contact the maintainer through @mrdulasolutions and wait for a private channel.

Include the affected component (console, mesh.py, Compose, example infra), versions or commit, and a minimal description of impact. Do not attach live dest cards, credentials, or production IPs unless the maintainer asks.

Please give us a reasonable window to patch before public discussion.

In scope (this repo)

• Operator HTTP API and UI
• Hosted-hub join (Mesh + Dest)
• Volume contents under /var/lib/civics (ICS_HOME + operator store). Older nodes may still use /var/lib/reticulum; that is a mount alias, not a Reticulum install.
• Compose port publishing and loopback console bind
• Example AWS templates and load scripts as published

Out of scope here (report upstream)

• ICS daemon, framing, identity — mrdulasolutions/ICS
• MMF pack/unpack — mrdulasolutions/MMF
• Your organization’s compliance boundary, or hosted hub operations

• Keep the console on localhost. Use SSH or SSM port-forward on production hubs.
• Publish TCP 4242 only to peer networks you intend to mesh with. Tighten PeerCidr (or equivalent) when you know those nets.
• Public community meshes (*.reticulum.network and listed public hubs) are blocked on purpose.
• docker compose down -v destroys identity. Back up with ./scripts/backup.sh before volume wipes.
• Joining a hub you host does not certify CivICS.

Never commit .env, .env.hub, AWS keys, backups/, or live hub dest/IP pairs. Prefer CIVICS_* environment names; GOVICS_* and GOVRET_* are compatibility fallbacks only.