Security

What vuzon does to keep a self-hosted panel safe, what is left to you, and how to report a vulnerability privately.

What vuzon does

Credentials and sessions

• The panel password is stored as a scrypt hash in the data volume. There is no AUTH_PASS variable and it never exists in plain text.
• Credentials are compared in constant time; login is rate-limited to 10 attempts / 15 min.
• Logging out from a live session invalidates the cookie server-side, not just the browser copy, and the revocation is written to disk so it survives a restart. A logout sent without a valid session only clears the caller’s own cookie — it cannot be used to sign everyone else out.
• Sessions expire 7 days after sign-in, enforced by the server on every request. The cookie’s maxAge only asks the browser to forget it; a cookie copied off the wire stops working on its own.

The Cloudflare token

• The token is never logged and never returned to the browser.
• Cloudflare’s error text is logged server-side only. Upstream 401/403 are normalised to 502, so an API-permission problem can’t be mistaken for your own session expiring.

The HTTP surface

• Every API response ships a strict CSP, nosniff, Referrer-Policy and Cache-Control: no-store.
• vuzon refuses to start with an obviously unsafe configuration — a template CF_API_TOKEN, an unwritable data directory — instead of coming up in a broken state.

The container

• Runs as a non-root user, read-only, with every capability dropped — see docker-compose.yml.

What is left to you

• Use an API token with least privilege — one zone, one account — never the Global API Key. See API token.
• Choose a panel password of at least 12 characters, and finish the setup wizard immediately — until you do, the panel has no owner. See Initial setup.
• If the panel is reachable from the internet, serve it over TLS and set COOKIE_SECURE=1. See Reverse proxy & TLS.
• Back up the vuzon-data volume and treat it as secret — see Backups.

Reporting a vulnerability

Do not open a public issue. Report it privately via GitHub Security Advisories.