Security for partners

How HF Panel protects the servers you run for customers, your partner API key and licences, and how to report a vulnerability.

When you put HF Panel on hundreds of customer servers, its security is part of your own. This page sums up what protects those servers and what you are responsible for.

How HF Panel protects a server

Root only through one checked door. The panel program runs as an unprivileged user. Work that needs root goes through a single helper, which checks every argument before it acts.
Each account's files are handled as that account. File managers, uploads, archives and backups of a hosting account run with that account's own rights, so one customer cannot reach another's files or the system's.
Two-step sign-in for administrators, resellers and customers, with single-use codes.
CSRF and session protection on every form that changes something; sessions are HttpOnly and SameSite=Strict.
No requests to private networks. Webhooks, uptime checks and other outgoing requests refuse private and internal addresses, also after DNS changes.
Signed releases. Every release and the list of software components are signed and checked with SHA-256 before anything is installed. A server refuses an unsigned or changed release.

More: Security model and the hardening checklist.

Licences and your API key

Licence answers are signed by the licence server; a server rejects an answer that was changed or made for another server.
Your partner API key is stored only as a fingerprint; nobody can read it back. Keep it on your own systems and replace it when people leave (see Get an API key).
Licence keys are not secret passwords, but treat them as account data: they appear in install commands and on the servers they belong to.

Reviews

HF Panel's code is reviewed for security before releases, and the results are published in Audit results. Partners who need an independent penetration test for their own compliance can arrange one with HostFog Ltd: ask through your partner support channel.

What you are responsible for

the servers themselves: the operating system, SSH access, the provider's firewall and snapshots;
keeping HF Panel updated (see Roll out updates);
your customers' own websites and applications;
your partner API key and webhook signing secret.

Report a vulnerability

Report security problems privately, as described in Vulnerability disclosure. The reporting address is also published in https://hostfog.com/.well-known/security.txt. Critical and high-severity fixes are released within 30 days, usually much faster, as signed patch releases.