Security fixes are applied to the latest version on the default branch.

Use GitHub's private vulnerability reporting when it is available for the repository. Otherwise, use the contact channel at limsumin.com. Do not include real access logs, IP addresses, authorization tokens, session identifiers, or private endpoint URLs in a public issue.

Embertop treats telemetry as sensitive operational data.

• The browser connects only to the same-origin /api/stream route.
• Upstream credentials are read from server-side environment variables.
• The web proxy drops unknown fields and re-applies path and text sanitization to custom upstream SSE frames.
• The collector does not emit client IP addresses.
• Query strings are dropped before an event is emitted.
• Numeric IDs, UUIDs, and long token-shaped path segments are redacted.
• Machine hostnames are not emitted unless an operator explicitly sets a site label.
• The collector binds to localhost by default and requires a token when configured to listen on a non-loopback address.
• Terminal mode uses the same redaction path as the collector.
• Tokens passed with --token may be visible in operating-system process listings. Prefer EMBERTOP_TOKEN or EMBERTOP_COLLECTOR_TOKEN.
• Redaction applies to the event Embertop emits, not to an existing Nginx source log. A combined log can retain client IPs, referrers, and query strings before Embertop reads it. EMBERTOP_INCLUDE_PATHS=false and --hide-paths change emitted data only. Prefer a privacy-minimized source log, restrict access to it, and keep retention short.

Embertop does not implement user authentication. Deploy it behind the authentication and authorization already protecting your backoffice. A public UI can reveal traffic patterns even when individual visitors are anonymized.

Never commit .env files or real collector configuration. Rotate EMBERTOP_COLLECTOR_TOKEN, EMBERTOP_UPSTREAM_TOKEN, and EMBERTOP_METRICS_TOKEN after any suspected disclosure.

npm run audit:dependencies blocks high- or critical-severity findings in runtime dependencies and any unrecognized high- or critical-severity finding in development dependencies.

The policy temporarily recognizes GHSA-mh99-v99m-4gvg in ESLint's development-only glob stack. Embertop does not pass untrusted glob patterns to this tooling, and the affected packages are not installed by production-only installs. The exception should be removed as soon as the Next.js ESLint plugin tree supports a patched dependency chain.