AppRankly is designed as a self-hosted, privacy-first application for managing and analyzing mobile app performance. Because AppRankly manages sensitive authentication credentials—such as Google Cloud Storage service account JSON keys, Apple App Store Connect .p8 private keys, and AI provider API keys—we take security extremely seriously.

Only the latest release and the current main branch receive security updates and patches. We strongly encourage all operators to keep their AppRankly instance updated.

If you discover a potential security vulnerability in AppRankly, please report it responsibly. Do NOT open a public GitHub issue for security vulnerabilities.

Please report security vulnerabilities by emailing the maintainer directly or opening a Private Security Advisory on GitHub:

• GitHub Private Advisory: Go to the repository's Security tab → Advisories → New draft advisory.
• Email: Reach out to the maintainer via GitHub profile contact details.

• A detailed description of the vulnerability.
• Proof-of-concept (PoC) code or step-by-step instructions to reproduce the issue.
• Potential impact of the issue (e.g., unauthorized data access, privilege escalation).
• Any proposed remediation or patch if available.

• Acknowledgement: Within 48 hours of report submission.
• Assessment & Fix: We will work to verify and release a fix as promptly as possible.
• Public Disclosure: A public advisory will be published once a patch is made available.

When operating AppRankly on your server, container, or cloud instance, please follow these security guidelines:

• Keep Secrets Out of Version Control: config.json and files in the config/keys/ (or data/config/keys/) folder contain sensitive API keys. They are listed in .gitignore by default. Never commit key files or configuration files to Git.
• Set a Custom JWT_SECRET: In production environments, explicitly set the JWT_SECRET environment variable to a strong, randomly generated string (e.g., openssl rand -hex 32). Do not rely on dynamic fallbacks in multi-container setups.

• Google Cloud Service Account: Grant only the minimal permission required ("View app information and download bulk reports (read-only)") in Google Play Console.
• Apple App Store Connect Key: Assign the lowest required role ("Sales and Reports") when creating API keys in App Store Connect.
• AI Provider Keys: Consider placing usage limits or spending caps on your OpenAI, Anthropic, or Gemini API keys.

• Use HTTPS / Reverse Proxy: Always deploy AppRankly behind a TLS-terminating reverse proxy (such as Nginx, Caddy, Traefik, or Cloudflare Tunnels) when accessing the dashboard over the public internet.
• Restrict Access: Place AppRankly behind authentication proxies (e.g., Authelia, Cloudflare Zero Trust, or VPN/Tailscale) if hosting on public infrastructure.

• AppRankly Docker images are configured to run as a non-root user (UID 1000:1000). Avoid running the container with --privileged or as root unless strictly necessary.
• Regularly update Docker base images and system packages.

Thank you for helping keep AppRankly and its user community safe!