RD-Bot is an experimental, personal-maintenance, single-machine self-hosted project (Experimental / Developer Preview). Only the following deployment is supported:

• one machine with Docker Engine / Docker Desktop and Compose v2;
• the admin UI published on 127.0.0.1 only;
• the Docker Compose stack started via ./scripts/rd-bot.sh (see README.md).

There is no security support for public-internet exposure, multi-user operation, enterprise authentication, or high-availability deployments. These are non-goals for the current release (see README "Current capabilities / Roadmap").

Please report security issues privately via GitHub Security Advisories on wanghehe123/rd-bot.

If advisories are unavailable, open a private GitHub security report / limited-visibility issue on that repository. Do not post exploit details in public issues.

The /admin HTTP API and static admin UI currently have no authentication (no Spring Security / SecurityFilterChain). Anyone who can reach the service can call admin endpoints.

Defense in depth for this release is network-layer only:

• a native (non-Docker) backend binds to 127.0.0.1 by default (SERVER_ADDRESS);
• the Docker stack publishes the app only on 127.0.0.1:${RD_BOT_PORT:-18080}.

Do not expose port 18080 to the public internet. Do not remove the loopback binding unless you add your own authentication layer in front (reverse proxy with SSO, VPN, etc.). There is no default username/password; the optional user/password module is not a security boundary and must not be advertised as one.

The rd-bot backend container mounts the host Docker socket (read-write) so it can create isolated Pi/QA agent containers. This is equivalent to root access on the host:

• only the rd-bot service receives the socket (never the agent containers);
• never run the stack on a machine where untrusted parties can reach the backend API;
• Pi/QA agent containers never receive the Docker socket, host secret directories, upstream model/GitHub credentials, or the backend's full environment — model access goes exclusively through the backend's credential relay.

Feishu IM intake (HTTP webhook), its local listener, and ticket write-back are disabled by default and are not part of the first release's supported surface. The runtime mutation endpoints fail closed when no RD_AGENT_RUNTIME_MUTATION_TOKEN is configured; there is no public default token.

• Load secrets from environment variables or local untracked files such as *.env and application-local.yaml.
• Never commit API keys, tokens, or credentials to the repository.
• deploy/docker/runtime.env (generated by ./scripts/rd-bot.sh up) is created with 0600 permissions and is gitignored.

Default MinIO / RustFS credentials in sample configuration (for example rustfsadmin) are for local demo only. Replace them before any shared or production-like deployment.