Security

XLADA is a fork of Remnawave under AGPL-3.0-only in which privacy and control over data are made a separate priority. This section is an overview page: the specific settings are described in Panel Security and Reverse Proxy.

The basic model is simple: the panel sits behind HTTPS, a node has no outbound connections, and user data is either not collected or deleted by retention.

What is already in place

Mechanism	Details
Sign-in brute-force protection	5 attempts per "login + IP" pair, 20 from one IP, 50 per login, with escalating lockout
Passwords	hashed and never included in failed sign-in notifications
Administrator action log	the admin_audit_log table: who, what, when, IP, result
Secrets at rest	the TOTP secret is encrypted (AES-256-GCM)
No external requests	the built bundle makes no calls to third-party services: icons, version checks, and telemetry are removed
Request bodies are not logged	only the method, path, result, IP, and time are written to the log

Data minimization

It is safer not to collect extra data than to clean it up later. If you do not need traffic history and subscription requests, disable their recording:

# .env
SERVICE_DISABLE_USER_USAGE_RECORDS=true
SERVICE_DISABLE_SRH_RECORDS=true
USER_USAGE_IGNORE_BELOW_BYTES=4096

For tables that do get filled, retention applies. By default, auto-cleanup is off — enable it deliberately:

Table	Default retention	Contains
admin_audit_log	30 days	who, what, when, IP
hwid_user_devices	90 days	HWID, OS, user-agent, IP
user_subscription_request_history	30 days	IP, user-agent
nodes_user_usage_history	14 days	without IP
nodes_usage_history	90 days	without IP

# .env — a single weekly job serves all tables
SERVICE_CLEAN_USAGE_HISTORY=true
SERVICE_CLEAN_OLD_LOGS=true

tip

The full list of variables and their default values is in Environment Variables.

What remains up to the administrator

Some of the work cannot be automated — it depends on your infrastructure.

danger

APP_SECRET is critical. Changing it breaks sign-in, JWT, and TOTP secrets. Keep the value in a secrets manager and do not change it after the first start.

• The panel and the subscription page are available over HTTPS only, HTTP is redirected.
• METRICS_PORT (3001) is closed to the outside: metrics are exposed on 127.0.0.1.
• NODE_PORT (2222) is open in the firewall only for the panel IP.
• Two-factor authentication (TOTP) is enabled for administrators.
• A link to the source code is available to users — §13 of the AGPL requires it.
• Image builds are taken only from the official xray-panel organization.

warning

The SSH terminal to nodes (Settings → Experimental) gives a command line on the node servers. The private key is stored encrypted in the browser and is not sent to the server, but the access is broad. Enable it only if you understand the consequences.

Checklist

• .env has 600 permissions and does not end up in other people's backups.
• APP_SECRET is saved in a secrets manager.
• HTTPS is configured, HTTP redirects to HTTPS.
• METRICS_PORT is closed to the outside.
• NODE_PORT is reachable only from the panel server.
• TOTP is enabled for all administrators.
• Retention periods are set and auto-cleanup is enabled.
• The source code link is specified in the panel branding.

What's next

• Panel Security — the mechanisms in detail.
• Reverse Proxy — TLS and the real client IP.
• HWID Device Limit — device binding.
• Migrating from Remnawave — how not to lose data during migration.