AIncient Labs, home

Safer defaults for new sites

Atelier 0.23.0 and Manager 0.15.0 give each new site its own database password, stop logging the first admin password, refuse a missing hash salt, and add security headers to every response.

ATELIER-SA-2026-004 ·

Severity
Moderate
Affected
Atelier < 0.23.0
Fixed in
Atelier 0.23.0

A review of Atelier's defaults against the EU Cyber Resilience Act's secure-by-default requirements found settings that were fine for trying Atelier out, but weaker than they should be for a site on a public address. None of them is reachable from outside a default install on its own. Atelier 0.23.0 and Atelier Manager 0.15.0 change them.

What is fixed

  • A shared database password. Every install used the same database password. The database is never published outside the appliance's own network, so this needed another foothold to matter. New installs now get their own random password. Existing sites keep theirs for now; a later update will rotate it, and atelier doctor tells you whether your site still uses the default.
  • The first admin password in the log. On a fresh install the generated admin password was written to the container log as well as to private/INITIAL_ADMIN_PASSWORD. Anyone who could read the logs could read it. It is now only in the file.
  • A fallback hash salt. If HASH_SALT was missing, the site started with a shared development salt, which makes one-time login links and form tokens predictable. The site now refuses to start without a salt of at least 32 characters. The installer and the Manager have always written one.
  • Missing security headers. The web server in front of your site now sends X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Permissions-Policy, and HSTS when the request arrived over https.
  • A smaller image. The image no longer ships a compiler, build headers or Drupal's own test files, and its base images are pinned by digest.

What to do

  • Update to 0.23.0. With the Atelier Manager, update the Manager to 0.15.0, then run atelier app update; the Manager brings the security headers to existing sites. Installed with the install script, re-run the installer as described in Upgrade.
  • If you set up by hand and typed a short HASH_SALT, replace it with openssl rand -hex 32 before updating, or the site stops. A new salt signs everyone out once.
  • Before your site faces the internet, read the new hardening guide: TLS, trusted hosts, secrets, backups and how to remove everything.
  • Keep .env with your backups. New installs keep their database password there.