HF PanelAudit results
The latest security audit of HF Panel 1.0.0: which tools scanned which code, the versions used, what was found and what was fixed.
The results of the security audit of HF Panel 1.0.0, made on 25 October 2026. It combined automated scans of all the source code with a manual review of the riskiest parts. This page lists what was checked and what changed, as it is.
What was scanned, and with what
| Tool | Version | What it checked |
|---|---|---|
| govulncheck | 1.1.4, Go vulnerability database of 20 October 2026 (4,710 entries) | the Go programs hf-api and HF Server, and every Go module they use |
| gosec | 2.23.0 | security patterns in the Go code of hf-api and HF Server |
| staticcheck | 2025.1.1 | bugs and dead code in the same Go code |
| ShellCheck | 0.9.0 | hf-agent and its 42 command files, and the 14 installer and update scripts |
| npm audit | npm 10.9.4 | the seven web interfaces (panel, HF Mail, HF Files, HF Studio, HF Server, documentation, website) |
The Go code was built and tested with Go 1.24.7, the web interfaces with Node.js 22.22.0.
What the scans found
| Scan | Result |
|---|---|
| govulncheck, Go modules | 1 module with a vulnerability the code can reach (the PostgreSQL driver, see Still open below); 1 module with a vulnerability the code never reaches (fixed below) |
| govulncheck, Go standard library | 48 vulnerabilities in hf-api and 46 in HF Server, all fixed in newer Go releases (see Still open below) |
| gosec | 484 findings in hf-api and 546 in HF Server. Every finding of high and medium severity was read. None was an exploitable problem: SQL is always built with placeholders and quoted names, commands run without a shell and with checked arguments, file paths are fixed or checked, and outgoing requests already refuse private addresses. The few deliberate exceptions now carry a written reason in the code. |
| staticcheck | 50 findings in hf-api and 60 in HF Server: style and unused code, none with a security impact |
| ShellCheck | 97 notes in hf-agent and 156 in the scripts, mostly style. None was a quoting or injection problem: every argument hf-agent receives is checked before it is used |
| npm audit, what ships to browsers | 0 vulnerabilities in all seven interfaces |
| npm audit, development tools | 3 (2 critical, 1 moderate) in the test runner of five interfaces, fixed below |
What was fixed
| Area | Change |
|---|---|
| Sign-in | a wrong username now takes as long to refuse as a wrong password, on the panels and in HF Files and HF Studio, so sign-in no longer tells which usernames exist |
| HF Mail | the development protocol log no longer writes passwords: sign-in commands are written without their credentials |
| HF Mail | attachments of unsent drafts are stored readable by hf-api only |
| Panel data | a restored copy of the panel database and the saved copy of the old settings file are created private from the start, never readable by others even for a moment |
| Account locks | the fallback lock file in the shared temporary folder never follows a symbolic link |
| HF Server on macOS | the administrator prompt that updates the hosts file escapes its command fully, so an unusual file path can't add commands |
| Website | publishes /.well-known/security.txt with the address for security reports |
| Go modules | github.com/klauspost/compress updated from 1.17.6 to 1.18.7 (GO-2026-5841) |
| Test runner | Vitest updated from 3.2.7 to 4.1.12 in five interfaces (GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr, GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8); it is used only by developers and never ships |
After the changes every Go test of hf-api and HF Server and every interface's tests pass.
Manual review
These parts were read line by line: sign-in, sessions, CSRF and two-factor login; the API tokens; the File Manager, HF Files and the web disk (paths, symbolic links, share links); unpacking archives; HF Studio's database access; the argument checks of hf-agent and every place the panel calls it; outgoing requests (uptime checks, webhooks, the speed test, alerts, push notifications); password hashing; sign-in limits; secrets in logs; and the file permissions the installer sets. Apart from the fixes above, no problems were found.
Still open
| Item | Risk | What is needed |
|---|---|---|
| Go standard library vulnerabilities (net/http, crypto/tls, crypto/x509, html/template and others) | high | build the release with a supported Go version (1.26.10 or later); Go 1.24 no longer gets security fixes |
PostgreSQL driver pgx 5.7.2 (GO-2026-5004, GO-2026-4771, GO-2026-4772) |
low | update to 5.9.2, which needs Go 1.25 or later. HF Studio's own queries never contain the text this problem needs, and a customer can already run any SQL on their own databases |