Security model
AcmeMux operates DNS credentials, ACME account material, certificates, and private keys on a trusted host. Its design narrows how that authority can be reached, changed, and reported.
Start with the boundary
AcmeMux protects against accidental disclosure, unsafe browser-driven changes, unexpected native files, unreviewed executables, and ambiguous operation handling. It cannot make a compromised host safe. Root, the configured service identity, filesystem readers, process inspection, memory access, swap, crash dumps, backups, and snapshots remain part of the operator's security boundary.
Run AcmeMux only on a host you administer. Keep the application listener on loopback, terminate HTTPS at a reverse proxy on the same host, restrict network access to intended administrators, and preserve the configured public origin.
The local bootstrap command creates the only administrator without placing a password in shell arguments or environment variables. Passwords use Argon2id. Sessions are stored as hashes, rotate after authentication, expire, can be revoked, and are protected by same-origin request controls.
AcmeMux checks canonical paths, ownership, access, modes, link counts, file types, and change evidence. It uses no-follow filesystem operations and same-directory restrictive replacement for managed native edits.
Managed operations require an accepted digest and build identity. A version string alone is insufficient. Changes in path, bytes, ownership, permissions, capabilities, platform, or source evidence block operation until reviewed.
The worker executes lego directly without a shell, standard input, inherited host environment, arbitrary arguments, or browser-defined commands. Process groups, descendant tracking, parent-death behavior, output bounds, and a hard operation timeout contain failures.
Secret handling
Reducing copies matters. AcmeMux edits credentials where lego expects them instead of turning its own database into another secret store.
Browser responses and review summaries never return saved provider secrets. Replacement actions describe that a secret changes without presenting either value.
Credential files require confidential ownership and permissions, safe path components, regular file identity, and no symbolic links.
Selected values are read only to construct the allowlisted broker environment and seed output redaction. Confidential buffers are cleared when the plan closes.
Bounded subprocess output is redacted before durable storage and sanitized again at the HTTP presentation boundary.
No analytics, crash reports, traces, or usage events are sent to the project maintainer or an AcmeMux service.
The native workspace and application state have separate recovery boundaries. Back up and protect each according to the authority it contains.
Private vulnerability reporting
Report suspected vulnerabilities privately by email. Ordinary defects, provider requests, and support questions belong in the public community repository after removing secrets, private keys, tokens, account material, and customer data.
Operator responsibilities
Coordinated disclosure