The roadbook / Security & consent

Security & consent

Be clear about who can connect and what they can do.

Remote access lets someone see information and make changes to a computer. That is why it should be clear who is connecting, what access they have, and how the session ends.

If you are receiving help

• Start with a technician you meant to contact.
• Check the support address and read the permission prompts.
• Close sensitive windows before sharing your screen.
• End the session if something is unexpected.

If you run or support a setup

• Give each person their own account and the access they need for their work.
• Use HTTPS and protect administrator credentials and verification factors.
• Keep track of computers that have a permanent agent installed.
• Maintain the agents, server, operating systems, and database.
• Protect logs and audit records, which can contain sensitive information.

Keep sensitive information out of public issues

Passwords, enrollment tokens, private signing keys, session codes, account records, personal screenshots, and raw logs should not go in a public repository or issue. Use a generic example when explaining a problem.

If you find a security concern

Private reporting instructions will be published with the source repository. Until then, do not publish details that expose a real setup or someone’s credentials. For a problem on a server you use, contact its administrator through your usual private channel.

What this guidance means

These are operating practices, not a security certification. The security of a particular setup also depends on its version, configuration, infrastructure, and administration.