Panel Security

What is already in place

Mechanism	Details
Brute-force protection on login	5 attempts per "login + IP" pair, 20 from one IP, 50 per login, with escalating lockout
Passwords	hashed; a password never appears in failed-login notifications
Administrator audit log	admin_audit_log table: who, what, when, IP, result
Secrets at rest	the TOTP secret is stored encrypted (AES-256-GCM)
No external requests	the built bundle makes no calls to third-party services: icons, version checks, and telemetry have been removed
Request bodies are not logged	otherwise passwords, tokens, and OAuth2 secrets would end up in the log — only the method, path, result, IP, and time are recorded
Retention	automatic cleanup of personal data on schedule (see Environment Variables)

What is logged and what happens to it

What	Where	Default retention	Contains
Administrator action log	admin_audit_log	30 days	who, what, when, IP
User devices	hwid_user_devices	90 days	HWID, OS, user-agent, IP
Subscription requests	user_subscription_request_history	30 days	IP, user-agent
Traffic history	nodes_user_usage_history	14 days	no IP
Node statistics	nodes_usage_history	90 days	no IP

Automatic cleanup is disabled by default: enable SERVICE_CLEAN_USAGE_HISTORY and SERVICE_CLEAN_OLD_LOGS if you want the retention periods to be enforced automatically.

Manual cleanup

On the Logs page, select the sources and click "Delete selected". The server additionally requires explicit confirmation (confirm: true), so cleanup cannot be triggered outside the interface.

The administrator action log is available on the Audit Log page: filters by administrator and result, plus pagination.

Administrator checklist

• APP_SECRET is stored in a safe place (a secrets manager, not a chat).
• The .env file has permissions 600 and does not end up in backups accessible to third parties.
• The panel is reachable only over HTTPS; HTTP redirects.
• METRICS_PORT is closed to the outside: metrics are served only on 127.0.0.1.
• Node port 2222 is reachable only from the panel IP.
• 2FA (TOTP) is enabled for administrators.
• A link to the source code is available to users (AGPL §13).
• The administrator password is kept in a password manager: the requirements are strict, but they are exactly what protects the single entry point.

SSH terminal to nodes

The feature (Settings → Experimental) gives you a command line on node servers. The private key is stored encrypted in the browser and is not sent to the server, but the access itself is very broad. Enable it only if you understand the consequences, and grant it to as few administrators as possible.

Reporting a vulnerability

Do not open a public issue. Describe the problem privately through Security Advisories in the repository.