LockWall is an independently maintained project, and its security is taken seriously. If you discover a security vulnerability, please do not open a public GitHub issue.
Please report security vulnerabilities via email:
A good vulnerability report includes:
- Description — what the vulnerability is
- Impact — what an attacker could do
- Reproduction steps — how to reliably trigger it
- Affected versions — which LockWall versions are vulnerable
- Proof of concept — code or commands demonstrating the issue (if applicable)
- Suggested fix (optional) — how it could be addressed
- Your contact info — email or PGP key for follow-up
- Disclosure preference — credited or anonymous?
We follow a responsible disclosure approach:
| Step | Timeline |
|---|---|
| Acknowledgement | Within 48 hours |
| Initial assessment | Within 7 days |
| Status updates | Every 7 days |
| Fix release | Depending on severity (Critical: ASAP; High: 30 days; Medium: 60 days; Low: next release) |
| Public disclosure | After fix release + 90 days (or earlier with reporter consent) |
- Remote code execution
- Authentication bypass leading to full system access
- SQL injection allowing data exfiltration
- Privilege escalation to admin without auth
- Authentication bypass with limited access
- Persistent XSS in web UI
- Disclosure of password hashes / API tokens
- DoS that crashes the service
- Path traversal allowing arbitrary file read
- Reflected XSS
- CSRF on sensitive endpoints
- Information disclosure (non-sensitive data)
- Denial of service requiring authentication
- Insecure default configurations
- Missing security headers
- Information disclosure of public information
- Issues requiring physical access
Security updates are provided for the latest version:
| Version | Supported |
|---|---|
| 2.1.x | ✅ Supported |
| 2.0.x | ❌ Not supported — upgrade for free |
| 1.x / pre-public builds | ❌ Not supported |
- ✅ Change default password immediately (forced on first login)
- ✅ Whitelist your trusted networks before exposing the service
- ✅ Don't expose port 8880 externally without an HTTPS reverse proxy
- ✅ Run as the Windows Service under LocalSystem, not as a user
- 🛡️ HTTPS reverse proxy (nginx, Caddy, IIS) for any external access
- 🛡️ Multiple admin accounts (in case one loses access)
- 🛡️ Review the Audit Log regularly for suspicious admin activity
- 🛡️ Monitor the Health page for early problem detection
- 🛡️ Keep LockWall updated — subscribe to GitHub releases
- 🛡️ Back up
config.yamlanddata\lockwall.dbregularly - 🛡️ Use API tokens with least privilege (Viewer role when possible)
- 🛡️ Rotate API tokens periodically
- ❌ Run LockWall with
host: 0.0.0.0without HTTPS in front - ❌ Disable the whitelist in production
- ❌ Share API tokens via insecure channels
- Password hashing:
werkzeug.security(scrypt by default) - API token storage: SHA-256 hash of high-entropy random tokens; the raw token is never stored
- Session keys: signed via a persistent per-install secret
- Random tokens: 256 bits of entropy from a CSPRNG
The following are not considered security vulnerabilities for this policy:
- Issues requiring physical access to the server
- Issues in third-party dependencies (report to upstream)
- Social engineering or phishing
- Network-level (volumetric) DDoS that floods the host independently of authentication failures — this is outside LockWall's scope (it acts on failed-login events, not raw traffic volume)
- Missing best-practice headers when LockWall runs behind a reverse proxy that handles them
Thank you for helping keep LockWall and its users safe! 🛡️
LockWall | support@lockwall.app