Browser never talks to the OS
UI calls only the Next.js BFF. Host and Linux operations go Next → Java (service key + identity headers). Metadata and auth go Next → Express (MySQL).
Trust
Security built for operators who own the blast radius
Commercial control planes fail when auth is decorative. CanonPanel treats identity, grants, and host power as first-class product — with an explicit trust boundary.
Related: feature depth · live availability · security.txt
Trust boundary
Browser → BFF → Express / Java
Deny-by-default API edge
Middleware requires a session cookie, Bearer token, or API key for almost all /api routes. Public allowlist is limited to health, auth login/refresh/reset/passkeys, and workflow webhook triggers.
Fleet least privilege
Non-root users need explicit server grants (read / operate / admin). Host file, shell, and security mutations enforce grant rank before Java executes.
Controls
What ships in the plane
Identity & sessions
Argon2id password hashing with pepper/envelope crypto, JWT access tokens in httpOnly cookies, refresh rotation, WebAuthn passkeys, and session revocation.
Authorization
RBAC permission codes, admin:* / root bypass for install owners, and per-server access levels for MSP-style estates.
Transport & headers
CSP, HSTS (production), nosniff, frame-ancestors self, referrer policy, and Permissions-Policy on matched responses.
Audit & ops honesty
Auth and sensitive actions write audit records. SMS alerts stay disabled until a provider is configured — no silent fake sends.
Disclosure
Report a vulnerability
Contact security@canonsoft.co.ke. Prefer coordinated disclosure. Machine-readable policy: /.well-known/security.txt.
FAQ
Security questions
Where are passwords and tokens stored?
Password hashes live in Express MySQL using Argon2id with layered pepper/encryption keys. Browser sessions use httpOnly cookies set by the Next BFF — access tokens are not kept in localStorage.
What happens if the shared service key leaks?
CANONPANEL_API_KEY grants service-level access between Next, Express, AI, and Java. Keep it loopback/internal-only, rotate immediately if exposed, and never publish Java or Express ports publicly without TLS and network policy.
How do I report a vulnerability?
Email security@canonsoft.co.ke and review /.well-known/security.txt. Include repro steps, affected version/commit, and impact. Do not open public issues with exploit detail until coordinated disclosure.
Are panel routes indexed by search engines?
No. Authenticated panel routes and login are noindex. Public marketing pages (/ , /features, /trust, /status) are indexable; robots.txt disallows /api and panel module paths.