> For the complete documentation index, see [llms.txt](https://docs.cstplus.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cstplus.org/documentation/guides/security.md).

# Security

CST+ has several layers of access control: some protect the admin panel, others protect your streams, and some protect the software itself from tampering.

***

### Admin panel security

#### Panel URL obfuscation

The admin panel does not live at `/` or `/admin`. CST+ generates an unguessable path (e.g. `/d682078df7c72e0ccde411b3`) that only you know. Requests to any other path return a 404 with no indication that an admin panel exists.

{% hint style="success" %}
You can rotate the panel path at any time from **Settings > Access**. Do this if you think the URL has been shared somewhere it should not have been.
{% endhint %}

#### IP allowlist

Restrict admin panel access to specific IP addresses or CIDR ranges in **Settings > Security > Admin IP allowlist**.

{% hint style="warning" %}
Localhost is always exempt from the allowlist, so you cannot lock yourself out via SSH. But if you add your browser IP and it changes, you will be locked out of the panel until you update the list via SSH.
{% endhint %}

#### Login rate limiting

The login endpoint is rate-limited per IP. More than 10 failed attempts per minute from the same IP triggers a `429`. Configurable in Settings > Security.

***

### Stream access control

{% tabs %}
{% tab title="Line auth" %}
Every stream request must include valid line credentials. Requests without credentials or with wrong credentials return `403 Forbidden`.
{% endtab %}

{% tab title="Connection limits" %}
Each line has a `max connections` setting. Exceeding it returns `429 Too Many Requests`. Active connections are visible in real time on the Dashboard.

{% hint style="success" %}
You can kill any specific connection from the Dashboard with one click, without affecting other viewers on the same line.
{% endhint %}
{% endtab %}

{% tab title="Per-IP cap" %}
Set a global limit on how many concurrent streams one IP can open across all lines in **Settings > Security > Max streams per IP**. This limits credential sharing.
{% endtab %}

{% tab title="Signed tokens" %}
Continuous TS streams require a signed HMAC token in addition to line credentials. The token is bound to the session and cannot be reused by someone who captures the URL.
{% endtab %}
{% endtabs %}

***

### Geo-blocking

| Level              | Where to configure                      |
| ------------------ | --------------------------------------- |
| Global (all lines) | Settings > Security > Blocked countries |
| Per line           | Line detail page > Blocked countries    |

{% hint style="info" %}
CST+ uses MaxMind GeoLite2 if a key is configured, or a free IP lookup service as a fallback. The fallback is accurate for most IPs but the first request from a new IP may slip through before the result is cached.
{% endhint %}

***

### User-agent and IP blocking

**User-agent blocking**: block streams to specific user agents in **Settings > Security > Blocked user agents**. Accepts exact strings and wildcard patterns.

**IP blacklisting**: blacklist an IP from the Dashboard connections panel with one click. Takes effect immediately across all streams.

{% hint style="danger" %}
IP blacklisting is permanent until you remove the IP from **Settings > Security > Blocked IPs**. Double-check the IP before clicking, especially on shared or mobile networks.
{% endhint %}

***

### Software integrity

CST+ verifies its own integrity at startup. Every file in the installation is covered by a signed manifest (Ed25519 signature). If any file has been modified, the service refuses to start.

{% hint style="danger" %}
If the integrity check fails after a legitimate operation, run `cstplus update` to restore a clean verified build. Do not try to work around the check by editing service files or unit files.
{% endhint %}

***

### License enforcement

| Event                 | What happens                                                                                                                              |
| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| License expires       | All channels stop; streams return 404; panel locks                                                                                        |
| License revoked       | Same as expiry, takes effect within the next check interval                                                                               |
| Account hold (review) | Non-blocking: channels keep running, panel stays usable, a banner asks you to resolve it in your account portal (usually within 24 hours) |
| Reactivated           | Channels restart automatically; panel unlocks                                                                                             |

{% hint style="info" %}
License status is re-checked on a configurable interval (default 30 minutes). A revoked license takes effect within that window, not instantly. An account hold is non-blocking; see Troubleshooting > License for how to resolve it.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.cstplus.org/documentation/guides/security.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.