Security

How to report a vulnerability in ZoPanel, what is in scope, how quickly we respond, our safe harbor for good-faith research, and how security fixes reach your servers.

Updated Oct 23, 2026

Draft — to be reviewed by legal counsel before publication.

ZoPanel manages servers that host other people's websites and e-mail, so security reports come first. If you believe you have found a vulnerability, we want to hear from you and will work with you to fix it. This page is our vulnerability disclosure policy; the machine-readable version is security.txt (RFC 9116).

Report a vulnerability

Open a ticket on the support page with the category Security report. Tickets are private between you and our team (they are not a public forum), and a ticket sent from a signed-in account lets us follow up with you directly.

Please include:

• the ZoPanel version (zopanel version, or Settings → Updates) and the operating system;
• the component affected (the web panel, an API endpoint, the root agent, the installer, the update channel, a billing module, the zopanel.net website or the license server);
• step-by-step instructions to reproduce, with the account role you used (administrator, reseller or customer);
• what an attacker could achieve, in your assessment;
• whether you want to be credited, and under what name.

No public disclosure before a fix. Please do not publish details, a proof of concept or an exploit (in a forum, an issue tracker, a blog or social media) before a fixed release is out and we have agreed a disclosure date with you.

Our response targets

These are targets, not contractual guarantees. We keep you informed while we work on the fix, agree the disclosure date with you, and describe the fix in the changelog once it is released, with credit if you want it.

Scope

In scope

• The panel: the zopanel program, its web interface and API, the root agent and the boundary between them, per-account isolation (files, processes, PHP, databases, mail, Docker apps), the web terminal, the file manager, backups, restores and imports, the provisioning API and the WHMCS, Blesta, HostBill and Paymenter modules.
• The installer: install.sh and what it sets up on a server.
• The update channel: update.zopanel.net, the signed release manifest, signature checks, the update guard and its rollback.
• zopanel.net and the license server: the website, customer accounts, checkout and license.zopanel.net (license checks, where a flaw affects the security of customers' servers).

We especially want to know about: a hosting customer reading or changing another customer's data; any path from a customer, reseller or API token to root or to administrator rights; authentication or two-factor bypass; remote code execution; injection into server configuration; a way to make a server accept an update ZoPanel did not sign.

Out of scope

• Denial of service: volumetric attacks, load testing, resource exhaustion of zopanel.net or the license server.
• Social engineering, phishing or physical attacks against our staff, customers or providers.
• Bugs in third-party applications themselves (WordPress and its plugins, App Store apps such as Nextcloud or Gitea, nginx, PHP, MariaDB, Postfix and so on) that are not caused by how ZoPanel installs or configures them. Please report those to their maintainers; tell us too if ZoPanel should ship a mitigation.
• Findings that need root, physical access, or an administrator account to harm only that same administrator's server.
• Spam, missing security headers or best-practice suggestions without a demonstrable impact.
• Websites and applications that our customers host on ZoPanel servers.

How to test

• Test only on servers you own or are authorised to test. Install ZoPanel on your own VPS; the Free plan is enough for most research.
• Do not access, change or delete data that is not yours. If you reach other people's data by accident, stop, do not keep it, and tell us.
• Do not degrade zopanel.net or the license server for others: scan them gently, or not at all.

Safe harbor

If you act in good faith and follow this policy, we will:

• consider your research authorised, and not pursue or support legal action against you for it;
• not report you to law enforcement for activity that follows this policy;
• work with you to understand and resolve the issue quickly;
• credit you publicly if you wish.

Good faith means: you report the issue to us promptly, avoid privacy violations, data destruction and service disruption, do not exploit the issue beyond what is needed to demonstrate it, and give us reasonable time to fix it before disclosure. This safe harbor covers our own claims only; we cannot authorise testing of systems that belong to others. If in doubt, ask us first. We do not currently run a paid bug bounty programme.

How fixes reach your servers

• Signed releases. ZoPanel ships as one binary. The release manifest is signed with the ZoPanel release key (Ed25519) and gives the SHA-256 of every file; the panel refuses an update whose signature or checksum does not match. The installer is signed too (install.sh.sig), and the installation guide shows how to check it before running it.
• Guarded updates. Every update snapshots the panel database, health-checks the new version and rolls back by itself if it is not healthy. See Updating ZoPanel.
• Security releases are flagged. A release that fixes a vulnerability carries the security flag in its signed manifest and a "Security:" line at the top of its changelog entry. The panel then shows ZoPanel X is available as a warning under Needs your attention on the administrator's dashboard, and owners of licensed servers still on an older release get an e-mail reminder. Turn on Automatic updates in Settings → Updates to install releases at 04:00 server time.
• Operating system packages. The installer turns on the distribution's automatic security updates (unattended-upgrades), and since 0.4.27 they include the PHP repository too. The Security Center on the Security page shows updates still waiting and a restart needed after a kernel update.
• What we watch. We track public vulnerability feeds (OSV, GitHub advisories, Ubuntu and Debian notices, CISA's Known Exploited Vulnerabilities catalog, and the Node.js, Go and PHP releases) for everything ZoPanel ships and installs, so a fix is prepared before customers have to ask.

How ZoPanel is built to limit a flaw

The web panel never runs as root: it runs as an unprivileged user under systemd hardening, and asks a separate root agent for a fixed list of actions, each parameter checked again by the agent. Every hosting account runs in its own systemd sandbox, file operations in a home directory run as that account's own Linux user, and Docker apps run in user namespaces. Read why in Why a hosting control panel should never run as root, and the details in the Security documentation.