Security

Authentication

• Passwords are hashed with Argon2id; a policy is enforced on every change.
• Brute-force lockout with progressive delays on the login screen.
• TOTP 2FA with recovery codes; forced password change on first login.
• Sessions are server-side, revocable (individually or all), and expire.
• Three roles: admin, developer, viewer — checked server-side on every API call.

Secrets & encryption

• Provider tokens (Cloudflare) and 2FA secrets are encrypted at rest with AES-256-GCM using a per-install key.
• Secrets are never returned to the browser — only fingerprints (····Fe).
• Terminal access uses single-use 30-second tickets, not long-lived tokens.

Audit log

Every meaningful action (logins, DNS writes, app deploys, firewall changes, rotations…) is written to an append-only audit log that forms a hash chain — tampering with an entry breaks the chain and is detectable (GET /api/audit/verify).

Self-hardening

• The panel runs as its own system user with a hardened systemd unit (no root).
• Firewall changes require confirmation within 60 seconds or they roll back.
• The web surface is a secret URL with byte-identical 404s for unknown tokens and per-IP rate limiting/bans at the relay.

Reporting a vulnerability

Open a private security advisory at github.com/Arsh0712/HypnoPanel/security/advisories/new — never a public issue. Response target: 72 hours.