Clear boundaries.
Visible limits.

Report a suspected vulnerability privately

Do not put credentials, customer data or exploit details for a live installation in public issues. Consult the repository security policy for the current private reporting route and availability.

How the current panel is separated

An unprivileged frontend sends bounded requests to a local agent. Customer workloads have distinct Unix identities, fixed storage volumes, private mount namespaces and resource controls. This is shared-kernel isolation.

What still needs work

MFA and recovery, secret encryption, signed updates, broader service-helper review, hostile workload testing and clean recovery drills remain planned work. Read the full security policy and verification notes before choosing the panel for customer workloads.

Ordinary bugs and improvements

Use GitHub Issues for non-security problems and proposals, with synthetic examples and redacted evidence.