Adminaway sits in front of an application's login route, so security reports are handled privately and with priority.

Security fixes are provided for the latest released minor version in the 1.x line.

Do not open a public issue for a suspected vulnerability. Email contact@marianposaceanu.com with the subject [adminaway security] and include:

• the affected version or commit;
• the impact and expected threat scenario;
• reproduction steps or a minimal proof of concept; and
• any suggested mitigation, if known.

You should receive an acknowledgement within seven days. Please allow time for investigation and a coordinated fix before public disclosure. Reports and reporter details will be kept private to the extent possible.

Adminaway is a defense-in-depth login gate. It does not replace authentication, authorization, multi-factor authentication, TLS, monitoring, or edge rate limiting. A report showing that Adminaway alone does not authenticate an admin is therefore not a vulnerability; a bypass of the documented gate behavior is.

Each configured seed contributes ten deterministic s1 tokens to a gate. A token carries a 72-bit HMAC tag, giving an effective online search space of approximately 2^68.7 across ten variants when only the primary seed is accepted. Each temporary previous seed adds ten more accepted values during rotation. This deliberate usability trade-off is intended for path concealment against online discovery, not for identity or session authentication.

The built-in limiter reduces online request throughput but adds no cryptographic entropy. Its default per-IP discriminator can be distributed across many source addresses. Production deployments should use a shared cache store across all Rails processes and complement the built-in limiter with a CDN, WAF, load balancer, or other edge/global control. Invalid and throttled gate requests intentionally return the same 404 response; secret-free notification events distinguish them operationally.

Gate URLs are reusable, do not expire individually, and should be treated as secrets. All ten variants rotate together when their seed changes. Applications that need individually expiring or consumable links should implement that workflow with application-owned persistent state.