Vulnerability disclosure

If you find a security problem in HF Panel, HF Mail, HF Files, HF Studio, HF Server or HF Tunnel, please tell us privately so we can fix it before anyone can misuse it.

Report a vulnerability

Email security@hostfog.io. The same address is published in https://hostfog.io/.well-known/security.txt, and every HF Panel server publishes its own administrator's address in its own /.well-known/security.txt.

Please include:

• the HF Panel version (in /etc/hostfog/VERSION, or on Server Admin › Server › HF Panel updates) and the operating system;
• the steps to reproduce the problem, and what an attacker gains;
• a proof of concept, if you have one.

Never report a vulnerability in a public forum post, ticket or code review. If you want to encrypt your report, ask for a key in a short first message without details.

Note: a problem with one server, such as a hacked website or spam sent from an account, is for that server's administrator, not for this address.

What happens next

We keep you informed while we work on it, and we thank you in the release notes unless you prefer not to be named. Fixes ship as signed releases: servers with automatic updates get them overnight.

Supported versions

Safe harbour

We will not take legal action against anyone who, in good faith:

• tests only on servers and accounts they own or are allowed to test, such as their own HF Panel server or the HF Server desktop app on their own computer;
• does not harm other people's privacy, data or services, and stops as soon as they reach data that is not theirs;
• does not use denial-of-service, spam, social engineering or physical attacks;
• reports what they found promptly and keeps it confidential until it is fixed.

If you are unsure whether something is allowed, ask first.

Scope

Related

• Security model
• Audit results