Skip to content
CatalystCatalyst Docs

Security

Panel

Section titled “Panel”
  • Serve everything over HTTPS with valid certificates (networking).
  • Keep the panel updated — security fixes ship in releases (updating).
  • Restrict who can reach the admin UI by network (VPN, allowlist) in addition to passwords.
  • Never expose the database or Redis ports to the internet.

Accounts and access

Section titled “Accounts and access”
  • Few admins, named accounts, prompt offboarding (users).
  • Least-privilege roles for staff; scoped API keys for integrations.
  • Treat node API keys and backup encryption keys as crown jewels: generated randomly, stored once, rotated on suspicion.

Nodes

Section titled “Nodes”
  • Only the agent’s required ports plus game allocations listen publicly.
  • Apply OS and runtime updates on a rhythm; nodes run untrusted game code and third-party mods by design.
  • Review imported egg install scripts — they are the largest untrusted-code surface in normal operation.

Report a vulnerability

Section titled “Report a vulnerability”

Do not open a public issue for a suspected security bug. See SECURITY.md in the main Catalyst repository for the private reporting channel, and expect coordinated disclosure: report, fix window, then public advisory.