Reporting Vulnerabilities

Introduction

NiceTryBot stands in front of other people's websites, so we take its security seriously. If you discover a security vulnerability in NiceTryBot, its add-ons, or its installer, we would love to hear about it, and we will work with you to fix it before it becomes public.

Reporting a Vulnerability

Please do not open a GitHub issue or discussion for a security problem, since everything there is public. Instead, send an email to hello@nicetrybot.com with the word "security" in the subject line.

What to Include

A good report helps us confirm and fix the problem quickly. Where you can, please include:

The NiceTryBot release you tested, which nicetrybot version will tell you, and any add-ons involved.
The component affected, such as the edge, the control panel, the gym, the installer, or an add-on.
Step-by-step instructions to reproduce the problem, along with any proof of concept.
What an attacker could achieve, and what they would need to get there.

Please test against an installation you own. Never test against someone else's NiceTryBot installation, or the sites it protects, without their permission.

Reporting With the Help of an Agent

If an agent helped you find the problem, it can also help you write the report. You may give it the following prompt:

Read https://docs.nicetrybot.com/docs/0.x/vulnerabilities.md. Then help me write a private vulnerability report for NiceTryBot about the issue we found, including the release, the affected component, exact reproduction steps, and the impact. Draft the email for me to send; don't send it or post anything publicly.

What Happens Next

A person reads every message sent to hello@nicetrybot.com, and we usually reply within two business days. We will confirm whether we can reproduce the problem, keep you updated as we work on a fix, and let you know when a release containing the fix is available.

Please give us a reasonable chance to fix the problem, and for installations to update, before you disclose it publicly. Security fixes are announced in the release notes on GitHub, and the control panel will show administrators an update notice once the fixed release is available.

Scope

We are interested in any vulnerability that could affect the security of a NiceTryBot installation, the sites it protects, or their visitors. For example:

Ways around the edge, the gym, or a domain's protection mode.
Access to the control panel, its API, or its MCP server without valid credentials, or beyond a user's team or role.
Ways to leak a domain's origin secret, an API token, or visitor data.
Server-side request forgery, injection, or remote code execution in any component.
Problems in the installer or the nicetrybot command that could compromise a server.

Bots that solve the gym's obstacles are not vulnerabilities on their own. Obstacles are designed to cost bots time and CPU rather than to be unbeatable. That said, if you have found a way to pass an obstacle without doing its work, we would still like to know.

Keeping Your Installation Secure

The best way to stay secure is to stay current. We recommend that you:

Update promptly when the control panel shows a new release, using nicetrybot update.
Keep your server's operating system patched, and expose only ports 80 and 443 to the world.
Lock your origins so that nobody can skip the edge.
Give API tokens only the abilities they need, and the shortest lifetime that works.
Keep your .env file, which holds your installation's secrets, out of source control and backups others can read.