One-pager. Read before exposing a Heratio instance to the public internet.

Out of scope (operator's responsibility):

• Operating system hardening (kernel, sshd, ufw)
• TLS certificate provisioning + renewal
• DNS / CDN / DDoS mitigation
• Backup encryption + off-site rotation
• Network segmentation (DB / ES / Redis on private interfaces only)

Run before https://your-domain is reachable from the public internet.

# 1. Database not bound to 0.0.0.0
ss -tln | grep :3306                         # expect: 127.0.0.1:3306 only

# 2. .env not world-readable
stat -c '%a %n' /usr/share/nginx/heratio/.env  # expect: 640

# 3. APP_DEBUG off, APP_ENV=production
grep -E "^APP_(DEBUG|ENV)=" /usr/share/nginx/heratio/.env

# 4. Admin password is not Merlot@123 / not the install default
mysql -u root -p heratio -e "
  SELECT username, email FROM \`user\`
  WHERE sha1_password = '\$2y\$12\$mFx…known-default-bcrypt-of-Merlot…';
"   # expect: zero rows

# 5. SSL cert valid + HSTS header set on 443
curl -sI https://your-domain | grep -iE "strict-transport-security"

# 6. CSP header present
curl -sI https://your-domain | grep -iE "content-security-policy"

# 7. Sensitive paths return 403
for p in /.env /vendor/composer.json /storage/logs/laravel.log /database/seeds/00_taxonomies.sql; do
  printf "%-50s %s\n" "$p" "$(curl -sI -o /dev/null -w '%{http_code}' https://your-domain$p)"
done   # expect: all 403/404

# 8. Login rate limit in place
for i in {1..20}; do curl -sw "%{http_code}\n" -o /dev/null \
  -X POST https://your-domain/admin/login \
  -d "email=admin@example&password=wrong"; done
# expect: 429s after a few requests (if rate limit configured)

# 9. KM, Qdrant, Cantaloupe (if installed) not publicly reachable
for url in https://km.your-domain/api/stats \
           http://your-domain:6333/ \
           http://your-domain:8182/iiif/3/; do
  curl -m 3 -sI -o /dev/null -w "$url -> %{http_code}\n" "$url"
done   # expect: all 403 / connection refused / timeout

# 10. No literal credentials in tracked files
git -C /usr/share/nginx/heratio grep -InE "(Merlot@|AtoM@|password\s*[:=]\s*[A-Za-z0-9!@#\$%^&*]{6,})"
# expect: nothing (only docs / placeholders)

1. Find the exposure: where did the secret land?

   # In tracked files
   git -C /usr/share/nginx/heratio grep -In "<the secret>"
   
   # In RAG corpus
   curl -s -X POST http://localhost:6333/collections/km_heratio/points/scroll \
     -H 'Content-Type: application/json' \
     -d '{"limit":2000,"with_payload":true}' \
     | python3 -c "import sys,json; [print(p) for p in json.load(sys.stdin)['result']['points'] if '<secret>' in str(p)]"
   
   # In server logs
   grep -r "<the secret>" /var/log/nginx /var/log/mysql 2>/dev/null

2. Contain: delete the offending Qdrant point IDs (POST /collections/<col>/points/delete); if in committed git history, the credential is forever burned - go to step 4.

3. Assess blast radius: log into each consumer service and find where the secret was used.

4. Rotate all instances of the burned credential. See /root/rotate-creds.sh for the established rotation pattern.

5. Patch the source: update sanitisers (/opt/ai/km/ingest_heratio.py:redact_secrets(), .gitignore, pre-commit hook).

6. Audit logs for evidence of malicious use during the exposure window: audit.db, nginx access logs, MySQL general_log.

1. Revoke all sessions: php artisan session:flush (or truncate sessions table).
2. Force password reset for all admin users.
3. Rotate APP_KEY (will invalidate sessions + encrypted columns; coordinate carefully).
4. Take a forensic snapshot before changing anything.
5. Compare vendor/ and node_modules/ to release tarball checksums.

What runs where on a single-host install. Lock down anything not explicitly LAN-only.

• OWASP Top 10 (2021) - baseline coverage targets
• Laravel security - framework-provided protections
• docs/standalone-install-plan.md - install architecture
• docs/standalone-install-howto.md - operator install steps
• /root/rotate-creds.sh (operator-only) - credential rotation script template
• 2026-04-30 incident: 4 credentials leaked via public KM /api/ask. Remediated in v1.37.1. See git log + feedback_km_no_credentials.md memory entry.