Search results

[Documentation] Add comprehensive security hardening guide for node operators

documentationDocumentation improvementsDocumentation improvements

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#21 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Critical Security] All bootnodes in bootnodes.list share the same key — enable eclipse attacks

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#20 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Security] Provide option to disable eth_sign and eth_sendTransaction on validator nodes

enhancementNew feature or requestNew feature or request

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#19 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Security] Wallet password file .pwd is empty — signing key unlocked without password

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#18 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Security] Add mandatory firewall setup to installation guide

documentationDocumentation improvementsDocumentation improvements

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#17 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Security] CORS domain defaults to * — enables cross-origin RPC attacks

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#16 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Security] docker-compose.yml exposes RPC/WS ports to all interfaces

dockerDocker/container relatedDocker/container related

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#15 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Critical Security] Remove debug namespace from default RPC_API — enables chain state destruction

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#14 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Critical Security] RPC must NOT bind to 0.0.0.0 by default — require explicit --enable-rpc flag

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#13 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Enhancement] Replace deprecated apt-key with modern GPG key management

enhancementNew feature or requestNew feature or request

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#12 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Bug] Inconsistent env variable names: INSTANCE_NAME (mainnet) vs NODE_NAME (testnet)

bugSomething isn't workingSomething isn't working

Status: Open.

#11 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026

[Bug] testnet/ directory missing env.example template

bugSomething isn't workingSomething isn't working

documentationDocumentation improvementsDocumentation improvements

Status: Open.

#10 In AnilChinchawale/XinFin-Node;

· AnilChinchawale opened on Mar 26, 2026