Security - PMIS-Project Management for Information Security

Reporting a vulnerability

Report vulnerabilities privately through GitHub: on the repository's Security tab, choose Report a vulnerability. Do not open a public issue. Include steps to reproduce, the affected version and the impact. See the security policy. Only the latest release is supported.

Built-in protections

Access control

Every request is checked on the server against the user's role and team. Users see only the projects, findings and reports they are entitled to. An Admin can allow or deny each feature per role under Settings > RBAC; Admins always keep every feature, and the Settings panel stays Admin only.

Passwords

Stored only as Argon2id hashes. Admins set a password policy, by default at least 14 characters with mixed character types. New and reset accounts must choose their own password at first sign-in.

Sessions

Session tokens are kept in HTTP-only, same-site cookies that scripts cannot read. Sessions expire after inactivity (15 minutes by default). Each user has one active session at a time. Signing out or changing a password ends the session.

Sign-in protection

Accounts are locked temporarily after repeated failed sign-ins, and request rates are limited.

Browser protections

Security headers, including a content security policy, block framing and restrict where content loads from. Changes requested from other websites are refused.

File handling

Uploads are size-limited and checked by content, not by name. Spreadsheets containing macros, formulas or embedded objects are rejected. Findings imported from a file are validated on the server, imported all or nothing, and kept in the one project they were imported into.

Minimal exposure

Only the web interface is published. Database, cache, storage and the API stay on an internal network, and the storage web console is switched off. Interactive API documentation is disabled in production.

Report downloads

Generated reports are downloaded through signed links that expire after one hour.

Audit trail

Sign-ins, account changes, project, template and report actions, library changes and settings changes are recorded with time, user and source address.

Data lifecycle

Completed projects and PoC screenshots are deleted automatically after the retention periods set by the Admin. Data owned by deleted users is purged after a 24-hour grace period.

Your responsibilities as operator

PMIS's protections depend on a correct deployment. You are responsible for:

Running a current version built from source or from a supported release. See Installation, step 4.
HTTPS through a reverse proxy, with COOKIE_SECURE=true and the exact FRONTEND_URL.
Strong, private secrets in .env, never committed or shared.
Network access: limit who can reach PMIS, for example to your VPN or office network.
Accounts: one named account per person, the least role each person needs, and prompt deactivation of leavers.
Backups: encrypted, stored off the server and restore-tested.
Updates to PMIS, Docker, the host and the object storage (RustFS) image.
Lawful use: PMIS is for Authorized Security Vendors and Service Providers only.

The full list is the production checklist.

Never do this on a real deployment

Enable SEED_DEMO. Its accounts have publicly known passwords.
Use docker-compose.dev.yml or the development setup scripts. They use fixed, published credentials.
Publish the database, cache or storage ports, or serve PMIS to users over plain HTTP.
Run the prebuilt Docker Hub images from before the current source's security fixes (last pushed 2026-10-08). Build from source until newer images are published.