Application security
CSRF validation, session handling, password hashing, prepared statements, predictable errors, and rate-limited entry points.
Security
Platform Hardening, Data Protection & Responsible Disclosure Reports
PanelConfig is structured around CSRF protection, session hardening, prepared statements, role-aware permissions, audit logs, rate limits, safe uploads, safe paths, and command allowlists
Operational evidence
Audit logs, login history, API request records, service events, job records, and security events help providers review what happened.
Automation safety
PCCLI, API tokens, jobs, and command allowlists are documented around least privilege and auditable operational work.
Security Philosophy
PanelConfig is built for hosting operations where mistakes must be traceable and high-risk actions should not disappear into scripts, ad-hoc shell history, or undocumented support work. The security model is based on accountable operations: role-aware access, CSRF-protected forms, prepared statements, rate-limited entry points, token handling, audit records, command allowlists, and job-based execution for sensitive operational work.
PanelConfig, LLC does not claim SOC 2, ISO, PCI, HIPAA, or independent audit certification unless such a review has been formally completed and published. The product security page is intentionally written around actual platform practices and operator responsibilities.
Application Controls
| Area | What PanelConfig focuses on | Operator responsibility |
|---|---|---|
| Authentication | Account login, password reset, email verification, session handling, and role-aware access paths. | Use strong passwords, protect owner accounts, remove unused operators, and review failed logins. |
| CSRF protection | State-changing forms use CSRF validation helpers to reduce unauthorized form submissions. | Do not bypass panel forms with unsafe direct scripts. |
| Prepared statements | Database access is structured through helper functions and parameterized queries where user input is involved. | Avoid manual database edits unless a backup and rollback plan exist. |
| Rate limits | Login and API surfaces use rate-limit helpers to slow repeated abusive attempts. | Use firewall rules and upstream protections for public-facing deployments. |
| Audit records | Operational records exist around changes, jobs, logins, API requests, services, and security events. | Review audit logs during support, abuse response, and post-incident investigation. |
Access Control
Provider operators should avoid sharing owner credentials. Use the narrowest access level that allows a team member to complete their work. Customer users should be kept inside PCUser unless provider-level access is required. Reseller and integration access should be reviewed carefully because those accounts often touch customer lifecycle workflows.
- Review owner, admin, reseller, and customer users regularly.
- Disable users that no longer need access instead of leaving dormant accounts active.
- Use separate accounts for people and automation.
- Check login history before and after suspicious support tickets.
- Record high-risk account, DNS, SSL, email, backup, and file actions through auditable workflows.
API Tokens
API tokens should be treated like server passwords. Store them in a secret manager, never paste them into public repositories, and rotate them when an operator leaves or an integration is replaced. PanelConfig stores token records and request logs to support review, but operators remain responsible for choosing safe scopes and protecting credentials outside the panel.
Automation should prefer job-backed operations where possible. A script that queues a backup, requests SSL, or reviews service state is safer than a script that directly edits production files without validation or history.
PCCLI Safety
PCCLI is intended for repeatable server-side operations. Command handling should stay inside allowlisted actions so panel users, support staff, and automation scripts do not become an uncontrolled shell interface. When a command changes server state, it should validate the request, run with the correct permission boundary, update job or service records where applicable, and leave an audit trail.
pc health
pc services:list
pc jobs:list
pc jobs:run-next
pc backups:run --account-id=31
pc ssl:issue --domain-id=44Files and Backups
Hosting panels touch sensitive customer data. File operations should keep safe paths, upload validation, and least-privilege access in mind. Backups should be tested before they are trusted. A backup that cannot be restored is only an archive, not a recovery plan.
- Keep backup storage separate from the account it protects.
- Test restores on staging before restoring production data.
- Review restore scope before replacing website files, databases, mailboxes, or DNS records.
- Watch for oversized uploads, unexpected executable files, and suspicious account changes.
Security Records
PanelConfig provides records and surfaces for firewall rules, WAF rules, IP blocks, malware scans, and security events. These records help providers explain what was reviewed and what action was taken. They do not replace server-level hardening, operating-system updates, SSH protection, network firewall configuration, or provider abuse monitoring.
Accountability
The safest hosting workflow is one where every important action can be reconstructed later. A provider should be able to answer who changed a DNS record, why an SSL order failed, when a backup was queued, which service was restarted, and whether a customer or operator made a change.
flowchart TD
A[Operator or automation action] --> B[Permission and validation check]
B --> C[Panel or job operation]
C --> D[Operational record]
D --> E[Audit and troubleshooting review]Disclosure
If you believe you have found a vulnerability in PanelConfig, contact support@panelconfig.com with a clear report. Please include affected area, reproduction steps, expected impact, screenshots or logs where safe to share, and whether the issue requires urgent review. Do not access customer data, disrupt services, or run destructive tests.
Security reports are reviewed by PanelConfig, LLC. Confirmed issues are prioritized based on severity, exploitability, affected product surface, and operational risk.
Operator Checklist
- Keep the server operating system and packages updated.
- Restrict SSH and administrative access.
- Use strong unique passwords and rotate shared credentials.
- Protect API tokens and remove unused integrations.
- Review failed logins, audit logs, API request logs, and security events.
- Test backups and document restore steps.
- Validate DNS and SSL changes before blaming the application.
- Use staging for imports, upgrades, SQL changes, and risky content updates.