The JoySword Online project prioritizes security, network isolation, database integrity, and safe process execution across all components.

We actively provide security updates and SRE sentinel patches for the following project release branches:

JoySword Online enforces a multi-layered security strategy:

1. Defense-in-Depth Network Isolation:

   • Automated network circuit breakers (manage-network-health.ps1) prevent loopback IP binding (159.203.165.171) to physical internet adapters (Ethernet), protecting host network interfaces from lease revocation or DNS corruption.

2. Zero-Admin Application Proxy:

   • An application-level proxy daemon (socket_proxy.py) operates with non-elevated user privileges on port 9100, removing the requirement for Administrator elevation.

3. Web Identity & Credential Hashing:

   • The Next.js 14 Web Portal uses Argon2id password hashing and Firebase Auth token verification for REST API endpoints (/api/account/sync).

4. Cryptographic Schema Drift Defense:

   • Cryptographic schema sentinels (db-schema-sentinel.py) fingerprint SQL catalog tables using SHA-256 baseline hashes to reject unauthorized column injection or schema tampering.

5. Atomic Anti-Corruption I/O:

   • Staged temporary writes and atomic pointer swaps (os.replace) guarantee zero zero-byte truncated configuration files upon unhandled crashes.

If you discover a security vulnerability or potential exploit in JoySword Online, please report it privately to our core maintainers before publishing it publicly.

• Email: Send your vulnerability details to security@joysword.org (or create a private GitHub Security Advisory).
• Required Information:
  1. Description of the vulnerability and potential impact.
  2. Step-by-step proof-of-concept (PoC) or reproduction script.
  3. Affected components, scripts, or database procedures.

• Acknowledgement: Within 48 hours.
• Triage & Assessment: Within 5 business days.
• Fix & Disclosure: Hotfix patch released within 14 business days.