docs/known-issues.md

@@ -69,17 +69,30 @@ block-list.
 ### ⚠️ Security note
 
 This plugin gives a **browser terminal that executes shell commands as the php-fpm user**
-(`atheos`) — and its own password gate is a **hardcoded, in-app constant**:
+(`atheos`). Two things matter:
 
-```php
-define("PASSWORD", "terminal");   // terminal.php:24 — you type this once per session
-```
+1. **The plugin ships with a well-known, hardcoded gate constant.** Upstream is literally
+   `define("PASSWORD", "<the default value in the plugin source>");`. Anyone who can reach the page
+   can read the source on GitHub and unlock it. **We have rotated it to a random value** — retrieve
+   it from the `PASSWORD` define in `plugins/Terminal/terminal.php` on the guest. It is deliberately
+   **not recorded in this repo** (see below).
+2. **It is a shell, so treat it as a privilege decision, not a convenience one.** Installing it
+   means the editor can run arbitrary commands as `atheos` — the same user that owns the deploy key.
 
-It is not a stored credential, but it is not a secret either: anyone who reaches the Login page can
-look up the source and unlock it. **This is the strongest argument yet for keeping the container
-LAN-only.** It also means plugin installation should be treated as a **privilege decision**, not a
-convenience one — see `docs/security-notes.md` §2 (S-7 covers disabling `exec`/`proc_open`, which
-would neutralise macros *and* this plugin).
+Because of (1) and (2), the in-app password is treated as a **secret**:
+
+- it is **not** written into this repo, the README, or the RUNBOOK
+- to read it: `ssh root@192.168.178.57 'grep PASSWORD /var/www/atheos/plugins/Terminal/terminal.php'`
+- it changes per install; `scripts/provision.sh` does not set one, so a rebuild returns to the
+  upstream default — **rotate it again after a rebuild**
+
+**Recommendation: remove this plugin unless you specifically want a browser shell.** It was installed
+during testing to diagnose a rendering problem; it is the single largest attack surface in the
+container. Note that Atheos macros already provide command execution, so the plugin adds little you
+do not already have — and macros are at least under your own configuration.
+
+`docs/security-notes.md` §2 S-7 covers disabling `exec`/`proc_open`, which would neutralise **both**
+this plugin and the macros. That is the correct lever if you ever expose this container.
 
 ---
 

patches/Terminal-terminal.php.patched

@@ -21,7 +21,7 @@ Common::checkSession();
 //////////////////////////////////////////////////////////////////////////////80
 $project = SESSION("project");
 
-define("PASSWORD", "terminal");
+define("PASSWORD", "<ROTATED - retrieve on the guest>");
 define("ROOT", Common::getWorkspacePath($project));
 define("BLOCKED", "ssh,telnet");
 // define("ENABLED", "java,ls,cd,echo,javac");