Security
Practical security guidance for a self-hosted Mise installation.
Internet-facing installations
- Serve Mise over HTTPS.
- Set
WEB_ORIGINto the exact public HTTPS origin. - Keep PostgreSQL and Meilisearch on private networks.
- Generate a unique
JWT_SECRETand store it in a secret manager or protected file. - Patch the host, Docker Engine, reverse proxy, and Mise regularly.
- Back up PostgreSQL and test restores.
Tokens
Personal access tokens begin with mise_ and authenticate REST API or MCP calls.
Create the narrowest useful scopes, set an expiry when practical, and revoke tokens
that are no longer used.
OAuth access tokens issued to MCP clients live for 24 hours and use rotating refresh tokens. Revoking the corresponding entry in Access Tokens disconnects the client.
Network exposure
Only the Mise HTTP port needs to be reachable through the reverse proxy. Do not publish PostgreSQL, Meilisearch, or Adminer to the internet. Adminer is included only in the development Compose file.
Reporting a vulnerability
Do not open a public issue containing exploit details or secrets. Use GitHub's private security reporting for the repository when available, or contact the maintainer privately before public disclosure.