HF PanelSecurity
How HF Panel keeps accounts apart and protects sign-ins, how to harden a server, how to report a vulnerability and the latest audit.
These pages are for administrators who run an HF Panel server and for security researchers. They explain how the software protects your server and your customers, and what you should do on top.
| Page | What it covers |
|---|---|
| Security model | how accounts are kept apart, what runs as root, signed updates, sessions, two-factor login, passkeys and API tokens |
| Hardening checklist | the steps an administrator follows on every new server |
| Vulnerability disclosure | how to report a security problem, what happens next, safe harbour and scope |
| Audit results | the latest automated scans and code review: tools, versions, findings and fixes |
Tip: for a guided version of the checklist, follow Secure the server in 15 minutes.