Security Settings
How to use Security Settings in Users & Permissions: access, working steps, fields, related records and troubleshooting.
Purpose and access
Create users and assign the roles required for their duties. System users and website users have different access. Test both allowed and denied record access; creating a role is not a reason to grant unrestricted administrator rights.
This page is a settings page in System Admin → Users & Permissions. Use the link above to open the configured destination; permissions are checked by the destination service.
Before you start
Review the current settings or existing records and prepare the information needed for the change.
Confirm the company, party, dates, units and source references that apply. Select existing links carefully and check for an existing record before creating a duplicate.
Working steps
- Open Security Settings from System Admin → Users & Permissions, or use ERP Search.
- Review the existing configuration before editing.
- Complete the editable fields described below. Required fields and validation conditions must be satisfied; read-only values are set by the system or their source records.
- Add the required child rows. Review each row’s identifiers, linked records and values, using the child-table field reference below.
- Save the record and address validation messages. Reload and verify the saved values and relationships.
- Use any additional workflow actions only when the record and your role provide them. Saving this record does not automatically complete a related transaction or external action.
Field reference
These fields come from the installed ERP definition. Hidden fields and password inputs are omitted. Additional conditions, custom scripts and workflow rules can make a field required or read-only in a particular context.
| Field | Type / behavior | How to use it |
|---|---|---|
Expirespublic_expires | Datetime Optional | Date after which this security.txt should be considered stale. Expires timestamp is converted to UTC. |
Contactpublic_contacts | Table Optional | Website, email or phone where vulnerabilities can be reported. Defaults to `https://security.frappe.io` Linked record: Security Settings Contact |
Preferred Languagepublic_languages | Table MultiSelect Optional | Defaults to `en` Linked record: Security Settings Language |
Policypublic_policy | Data Optional | Guidelines and policies on vulnerability reporting. Defaults to `https://frappe.io/security` |
Previewsecurity_txt | Small Text Optional · Read-only | Provide concise contextual information relevant to the record. Avoid unrelated personal or confidential data. |
Child tables
Contact — child-row fields
| Field | Type / behavior | How to use it |
|---|---|---|
Typetype | Select Required | Choose one of the configured list values. Status fields may be controlled by the record workflow.Available choices
|
Contactcontact | Data Required | Enter the identifier or short text requested by the label. Preserve external reference numbers accurately. |
Preferred Language — child-row fields
| Field | Type / behavior | How to use it |
|---|---|---|
Languagelanguage | Link Required | Choose an existing linked record. Check its company and ownership; typing a label alone does not create a new relationship. Linked record: Language |
Troubleshooting
- Not permitted: verify the account, role and source-document permission. Do not share an administrator login.
- Missing record or address: inspect the relevant Link or Dynamic Link fields; a matching title alone does not establish a relationship.
- Cannot save or change status: review required fields, read-only values, document status and the configured approval transition.
- Unexpected report or portal result: review company/date filters, source-document submission and the approved party or Employee link.