Security

Built and lab-tested

• Privilege separation: the panel runs as an unprivileged user and can only ask the root agent for operations declared in a module manifest, with typed parameters.
• Sign-in with passkeys first, passwords (Argon2id), authenticator codes and recovery codes. Two-factor sign-in is required for administrators and resellers.
• Step-up confirmation for risky actions, a device list with instant sign-out, scoped API tokens and lockout after repeated failures.
• A PIN after sign-in and trusted browsers: keep one browser signed in and come back with a short PIN. The browser is proven by a key that cannot leave it and a cookie that changes at every visit, so a stolen cookie alone gets nothing. The fifth wrong PIN removes the browser. Trust ends when the password changes, the person is suspended, the PIN is removed or the days run out (30 by default, 90 at most).
• A PIN is never a step-up factor: risky actions still ask for a passkey, an authenticator code or the password.
• An nftables firewall with presets, rate limits and country rules. Every change arms a rollback timer, so a bad rule cannot lock you out.
• CrowdSec intrusion prevention. Nothing is shared with the CrowdSec network unless you turn it on.
• Malware scanning with ClamAV and YARA, with quarantine and restore.
• File-integrity baselines for system binaries and configuration, hardening checks with a dry-run fix, and a listening-port audit.
• Unattended security upgrades with a service health watch that restarts anything an upgrade knocked over.
• A security score from 0 to 100 with suggested fixes, and a hash-chained audit log you can verify.
• Single sign-on with OIDC: your second factor still applies, nobody becomes an administrator from a claim unless you switch that on, and administrators always keep a local way in.
• Single sign-on with SAML: a response is validated against the provider's pinned certificate, with metadata import and download, certificate rollover and a test sign-on. In the lab, 24 of 24 forged or altered responses were refused.
• Sign-in alerts for a new country or impossible travel, with a 'this was not me' answer.
• Every audit checkpoint can be copied off the server by syslog or signed webhook, and a screen compares a pasted copy against the log.