WAF
Coraza with the OWASP Core Rule Set. On by default for your apps.
Security
Security: what is and isn't there
The panel talks to your server's Docker, so security here is the job, not marketing. We list the built-in layers and the known limits plainly.
Built-in protection layers
Rate limiting and auto-ban
Per-IP request limits; automatic IP bans after repeated bad requests; manual bans and allow lists.
Passwords and sessions
Passwords are stored with scrypt. Session cookies are HttpOnly and SameSite. Two-factor authentication (TOTP).
Encrypted secrets
Environment variables, tokens and keys are stored encrypted in the database with AES-256-GCM.
Security headers
A strict content security policy (CSP), CSRF protection and framing protection.
Docker firewall
Only 80/443 and the database ports you open are reachable from outside; Docker bypassing the firewall is blocked.
Signed images
Published images are signed with Sigstore (cosign); an SBOM and provenance are published with them.
Webhook signatures
Git webhooks are verified with a shared secret (HMAC); signatures can be required.
Image scanning
A Trivy scan after deploy, shown as a "what to do" card (informational, it does not block the deploy).
Known limits
We don't hide these, because you should know them before trusting us with your server.
An admin is equivalent to root on the server
The panel reaches the Docker socket, so an admin account can take over the server. Turn on two-factor authentication for admins.
The member role is not yet a strong security boundary
Give the member role only to teammates you trust. An independent review found gaps in permission checks that need fixing; we are working on them.
Isolation can be bypassed in Compose apps
Project networks are designed for single-container apps and databases. For apps deployed with Compose we don't currently guarantee this isolation.
Installs outside signature verification
Since 1.3.1, install and update verify the image signature and stop if it fails. Installs built from source and those run with `XUDBIN_VERIFY=0` are not verified; panels updated from 1.3.0 get the protection from the next update.
Backups are unencrypted; verification covers databases only
Database and folder backups are stored unencrypted. "Verified backup" covers database backups only.
No WAF on the panel's own address
The WAF protects your apps; the panel's own address only has rate limiting.
Independent review
On 2026-10-17 the panel's source code was reviewed independently, read-only. The findings are reflected in the limits above; we are working on closing them. This was a code review, not a penetration test; we will run dynamic tests separately.
Our recommendations
- Turn on two-factor authentication for admin accounts.
- Give the member role only to people you trust.
- Put access to the panel behind a VPN or Cloudflare Tunnel when you can.
- Keep the panel up to date and check regularly that backups restore.
Reporting a vulnerability
If you find a vulnerability, please don't file it as a public issue; report it using the method in the repository's security policy.