How HF Panel keeps your server safe
HF Panel is built so that a fault in the part that faces the internet can’t become a fault of the whole server. Here is how, what our latest checks found, and how to tell us about a problem.
How it is built
The panel never runs as root
The web program runs as an unprivileged system user. Work that needs root goes through one narrow door: a root helper with a fixed list of commands, each argument checked before anything runs, and no shell built from what you type. In October 2026 every one of its 161 commands was called with about 74 hostile values each; every bad value was refused.
File work runs as the account
Files, archives, imports, backups, cron jobs and the web terminal act with the hosting account’s own Linux user, so a link or a crafted archive planted in one account can’t reach another account or system files. Unpacking refuses paths that climb out, links that escape and archives that expand too much.
Two-step sign-in and passkeys
Authenticator codes, passkeys and single-use recovery codes for administrators, resellers, customers and team members, and a policy that can require them. Each code works once, even when two sign-ins race.
Strict browser rules
Panel pages send a Content-Security-Policy: scripts only from the server itself, forms only to its own addresses, and no framing by other sites. Sessions use HttpOnly, SameSite=Strict cookies and every change needs a CSRF token.
Signed releases and components
Each release’s details are signed (Ed25519) and the download must match their SHA-256 checksum; the package’s own signed file list is checked again before it runs. Third-party components are pinned by SHA-256. A server refuses an unsigned or altered release and never installs an older version over a newer one.
Accounts kept apart
Each account has its own Linux user, its own PHP workers and its own CPU, memory and process limits. Cron jobs and SSH can run in a sandbox, and accounts can’t see each other’s processes. A web application firewall and per-website IP rules sit in front of every website.
Outgoing requests (webhooks, uptime checks, alerts) refuse private and internal addresses, secrets are never written to logs, and if the licence server can’t be reached, websites, email and DNS keep running. The security model in full
What we checked, and what we fixed
In October 2026 we reviewed HF Panel in three passes, from reading the source to attacking a real install as each kind of user. It found seven issues, one of them high severity; all were fixed with tests before the release. On 25 October the whole source was scanned with automated tools and the riskiest parts were read line by line.
November 2026 free-tool scan
On 2 November 2026 the whole source was scanned again with free tools: govulncheck, gosec, semgrep, ShellCheck and npm audit. There was no critical finding and no exploitable injection, path traversal, XSS or CSRF problem in our code. What it found is fixed:
| Area | Change |
|---|---|
| Go | Every Go program is built with Go 1.26.10 instead of 1.24.7, which no longer gets security fixes. govulncheck now finds 0 vulnerabilities the code can reach. |
| Go modules | The network, crypto and text libraries and the PostgreSQL driver updated to fixed versions. |
| Panel backups | Opening a panel backup stops at 4 GiB for one file and 8 GiB in all. |
| Lock files | Readable by the panel’s user only; the temporary-folder fallback is a private folder. |
| HF Local on macOS | The start-up error box escapes its title and text. |
| Root helper | Two lists are joined without shell wildcard expansion. |
After the fixes, npm audit finds 0 vulnerabilities in what reaches your browser, and nothing from these scans is still open. The tools, versions and every result are on the audit results page.
An independent audit is planned
These reviews and scans were made by us, not by an independent firm. An independent penetration test is planned, covering sign-in, access between accounts and panels, the root helper, account isolation, the release chain and the licence server.
Report a vulnerability
If you find a security problem in HF Panel, Mail, Files, DB Studio, HF Local or HF Tunnel, email security@hostfog.com privately, never in a public post. The same address is in our security.txt.
- We confirm your report within 3 working days and assess it within 10 working days.
- Critical and high severity fixes are released within 30 days; others normally within 90.
- Good-faith research on your own servers is covered by our safe harbour.
Scope, safe harbour and what to include: vulnerability disclosure policy.
A hacked website or spam from one server is for that server’s administrator, not for this address.
Secure your own server
Two-step sign-in, the firewall and the malware scan, step by step.