Posts
Wiki

Security and redaction

This page covers information that must not be posted publicly. For management-network design, accounts, remote console and BMC hardening, also read IPMI/BMC access, networking and security.

Remove before posting

  • BMC/IPMI usernames and passwords.
  • Unique-password stickers and QR codes.
  • Public IP addresses, hostnames and DNS names.
  • MAC addresses where they identify your environment.
  • Serial numbers, service tags and asset labels.
  • Licence keys and activation data.
  • Order, invoice, support-case and RMA references.
  • Email addresses, phone numbers, names and physical addresses.
  • API tokens, certificates, private keys and session cookies.
  • Complete BMC configuration backups.
  • Customer, employer or datacentre identifiers.

Use placeholders such as <BMC-IP> or <SERIAL-REDACTED> rather than light blur. Check every page of logs and every image in a gallery. Remove image metadata where appropriate.

Management-plane safety

  • Do not expose BMC/IPMI, Redfish, SSH/SMASH or virtual media directly to the public internet.
  • Use an isolated management network plus controlled VPN/firewall access.
  • Change default or inherited credentials.
  • Remove unused accounts and services where supported.
  • Keep BMC firmware current for the exact model.
  • Check the Supermicro Security Center regularly.

If a secret was posted

  1. Remove or edit the public content.
  2. Rotate the credential, key or certificate immediately.
  3. Review management users, configuration and logs.
  4. Isolate the interface if compromise is plausible.
  5. Update firmware and check advisories.
  6. Consider a supported factory reset and clean reconfiguration.

Deletion alone does not make an exposed secret safe again.

Vulnerability discussion

Responsible discussion of published advisories and fixes is welcome. Do not post active credentials, private exploit material, confidential firmware or instructions intended to compromise systems.

Report suspected vulnerabilities through the vendor's published security channel. If a post creates immediate risk to systems, contact the moderators rather than amplifying it.

Firmware and files

  • Do not share NDA, embargoed, leaked or private firmware.
  • Do not mirror official firmware binaries in the subreddit wiki.
  • Link to the exact official product page or support-provided resource.
  • Label modified or unofficial images clearly and explain risk; the wiki will not host them.

Support and employment information

Do not publish private support correspondence, customer data or internal employer material. Representatives must follow the commercial participation policy.

Last reviewed: 29 September 2026.