Subscription tokens, node passwords, WireGuard private keys, and external-controller secrets are sensitive. If exposed, they may let others use the credentials or control a local interface. Delete public copies and rotate exposed credentials. Bind the control interface to 127.0.0.1, set a random secret, and update every client still using the old credentials.
Which information must be treated like a password?
Search configurations and logs for token, password, uuid, private-key, psk, and secret, and check whether the control interface listens on a non-local address.
- Does the subscription URL include token, key, password, or user parameters?
- Does the configuration contain password, uuid, private-key, psk, or secret?
- Does a screenshot or log expose a complete URL and authentication header?
- Does external-controller listen on a LAN or public address?
What to do immediately after exposure
- Redact the complete subscription URL, node credentials, and secret before posting screenshots(See Privacy policy)
- Set secret to a strong random value
- When external-controller is used only locally, bind it to 127.0.0.1(See External Controller)
- If you suspect exposure, ask the configuration provider to reset the token or subscription link