Security

ProxYard works on your Proxmox VE servers with your rights, so it has to be safe itself. It changes nothing you have not confirmed, every release is tested before it ships, and the last releases are checked again every night against the newest advisories.

Status

No known vulnerabilities in the checked releases.

Nightly scans

Every night the NuGet packages of the last three releases are checked for known vulnerabilities, direct and transitive. Findings become a warning on this page.

The first nightly check has not run yet.

Release checks

A release only ships when every gate passes: the unit tests (the app, the city and the website) and a check of all NuGet packages for known vulnerabilities. If one fails, nothing is built or published. More in the docs.

Safe by design

ProxYard installs nothing on the server and changes nothing on its own. Servers can be locked to read only, and actions your PVE role may not use are off. Actions say what they do and deleting a guest needs its VMID typed. Passwords and token secrets stay in the keychain of your computer. Proxbit has no tools of its own and can only propose. The app's server listens on 127.0.0.1 only. Details.

Update notices

ProxYard reads the update feed of proxyard.net/download once an hour. If a newer version is out, the app offers it. Nothing about your servers is sent. The check can be turned off in the settings (Updates). The result of the nightly scans is also at proxyard.net/api/status.

Reporting a vulnerability

Please do not report security problems in public. Write to info@lixsl.net instead, with the ProxYard version, your system, what you did and what happened. You will get an answer within a few days. The contact is also in security.txt.