Report a vulnerability
Please report security problems privately, not in a public issue: open the Security tab of the repository and click Report a vulnerability, with the affected version and how to reproduce it. We confirm reports within a few working days, fix confirmed problems in a new release and credit the reporter in the release notes unless they prefer otherwise.
Security fixes are released for the newest version. Machine-readable contact: security.txt.
How RMMZit protects your computers
Console
The console and the agent endpoint are separate ports; the console accepts only your allowed networks, checked before TLS. Two-factor sign-in for every account, argon2id passwords, short sessions, progressive blocking of failed sign-ins, CSRF protection, a strict Content-Security-Policy and a hash-chained audit log.
Agents
Agents connect outbound only — managed computers need no open ports — pin the server certificate when they enroll, and run only commands signed by the server and checked by the agent.
Remote access
Remote desktop, terminal and files only for users with access to that customer; every session and action is recorded in the audit log, and an optional notice on the remote screen tells the user that someone is connected.
Your network only
No cloud service, no telemetry, no account with us. Root actions of the console (updates, network, time zone) go through a separate helper with a fixed set of validated requests; diagnostics remove passwords, tokens and keys.
How releases are protected
- Every release is signed with the RMMZit Ed25519 release key; consoles and agents verify the signature and checksums before installing an update.
- The install script verifies the signature and checksum of the release it downloads.
- Packages are built from tagged commits; images carry a written source offer (
SOURCE-CODE.txt). - A console update backs up the database first and rolls back automatically if the new version does not start.
How RMMZit is tested
On every change (GitHub Actions)
| Check | What it finds |
|---|---|
| CI | go vet, the full test suite against an embedded PostgreSQL, staticcheck, gosec, govulncheck and Gitleaks; Linux and Windows builds |
| CodeQL | Injection, path traversal, unsafe redirects and other data-flow bugs (Go, JavaScript, workflows) |
| govulncheck | Known vulnerabilities in Go and in the dependencies the code actually calls |
| staticcheck | Bugs and dead code |
| Dependabot | Vulnerable or outdated Go modules and actions |
| Secret scanning | Credentials committed by mistake (with push protection) |
| OpenSSF Scorecard | Supply-chain practices of the repository |
Before releases (in a test lab)
| Check | What it finds |
|---|---|
| gosec | Insecure Go patterns: command execution, file permissions, weak cryptography |
| Semgrep | Injection, XSS, insecure cookies, open redirects (Go, JavaScript, secrets, OWASP Top 10 rules) |
| Trivy | Vulnerable dependencies, secrets and misconfigurations |
| Gitleaks | Secrets in the whole git history |
| OWASP ZAP | Full scan signed in as an administrator: XSS, SQL injection, CSRF, path traversal, header problems |
| OpenVAS and nmap | Network-level vulnerabilities, open ports and TLS settings of the appliance |
| End-to-end QA | Enrollment, monitoring, alerts, remote desktop, terminal, files, scripts, updates, roles, LDAP and SSO on real Windows and Linux machines |
Findings are fixed before the release; accepted risks are documented in the release notes.
This website
rmmzit.com is a static site: only a language cookie, no analytics, no trackers, no third-party scripts or fonts, and a Content-Security-Policy that allows no scripts at all. See the privacy policy.