KNJ Panel · Security
Independent audits, run as we build
Every audit below runs against the actual live dev build, not a cleaned-up snapshot before release. We publish what each pass covers and what it found — including the things that needed fixing — with no code and no private server details. That's the point: you can see this is a habit, not a one-time checklist before launch.
11
Audits run
0
Open critical issues
30
Found & fixed same day, all-time
14
Issues found, latest audit (#11)
170
Commits covered, latest pass
Audit #11: 14 issues found and fixed, full test suite re-run clean, then the audit re-run afterward found nothing left.
Latest audit: #11 · 2026-08-17 · scope: a pre-release "check every line" pass ordered ahead of the audit itself — fix everything first, then run the audit clean. Dedicated full-codebase sweeps covered every controller, the whole services layer, all 182 views, all 62 models, and the entire ~6,000-line provisioning script line by line, not just what changed since the last pass. 14 issues found and fixed, including 11 instances of one root-run symlink-safety bug class found by re-sweeping the whole script after the first two turned up in a scoped review
A Root-Run Symlink Bug, Found Twice As Hard
A scoped review turned up two instances of the same bug class: a privileged file operation that never checked whether its destination was a symlink an account owner could have pre-positioned. Rather than fixing just those two, the whole ~6,000-line provisioning script was swept for the same pattern — 9 more instances turned up, including in code already covered by earlier audits. All 11 fixed with one shared safety check.
11 instances · 1 bug class · all fixed
Config Injection Via An Ordinary File Manager Folder Name
Two features embed a folder name straight into a generated web server config block. The File Manager itself allows almost any character in a folder name — completely reasonable for plain file storage — but neither feature restricted what it would accept for its own purposes. Closed with a dedicated charset check on the two features that actually need one, not a blanket restriction on the File Manager.
2 features · 1 fix
Secrets Moved Off The Process List, Onto Real Encryption
Several database and mail passwords were briefly visible to any other local user on the server for as long as the command handling them ran — closed by switching every one to a private input channel instead. Two long-lived access tokens were sitting in the database as plain text; now encrypted at rest, verified with a real round-trip against the live database, not just a unit test.
7 call sites · 2 tokens now encrypted
Full Re-Test, Then A Clean Re-Audit
All 14 issues fixed, then the full test suite re-run (1,414 passing, zero regressions), then a fresh audit pass against the fixed code — which came back clean, as intended. Every fix live-verified on panel-dev itself, not just in the test suite: the self-server edit guard, the folder-name charset check, and a real encrypted-token round-trip against the production database.
1,414 tests · 0 regressions · 0 issues left open
Audit history
The full write-up for each pass stays in our private engineering log — this is the shape of what we share publicly: what was covered, what came of it, nothing more.
2026-08-17
Audit #11 — a pre-release "check every line" pass, ordered before the audit itself: fix everything found, then run the audit clean. Dedicated sweeps covered every controller, the whole services layer, all 182 views, all 62 models, and the full ~6,000-line provisioning script line by line. 14 issues found and fixed — the largest was one root-run symlink-safety bug class (11 instances, found by re-sweeping the whole script after the first two turned up) — plus config injection via a File Manager folder name, several passwords briefly visible via the server's process list, and two access tokens moved from plaintext to encrypted storage. Full test suite (1,414 tests) re-run clean, every fix live-verified on the real server, and the audit re-run afterward found 0 new issues. 0 open.
2026-08-14
Audit #10 — a targeted review of everything shipped since #09: Server-Side Cron Jobs, real AWStats, Feature Manager, SSL/TLS, self-service Perl Modules, and Upgrade Database Version — the highest-risk addition this window. Secret scan across all three repos clean; every new route's actual middleware chain checked directly. The database upgrade tool was genuinely live-tested on a disposable server built for exactly that, which found and fixed one real bug before it could ever reach a live customer install. 0 issues open.
2026-08-12
Audit #09 — a 5-day break, then a full intrusion-detection sweep instead of a code review — no new commits in scope. Every server's complete login history traced, every access control tested live, one database restart investigated and explained. 0 issues found, 0 open.
2026-08-07
Audit #08 — everything shipped since #07: the App Installer's rebuild into a five-app catalog (WordPress, Drupal, Nextcloud, MediaWiki, phpBB). 3 issues found, all fixed the same day. 0 open.
2026-08-06
Audit #07 — everything shipped since #06: SSL/TLS, Databases, OS package management, Packages & Resellers, Server Configuration, the full Email section, Domains, Files, account-side Databases, Metrics, DNS Lookup, Team Access, and real phpMyAdmin. 13 issues found, all fixed the same day. 0 open.
2026-08-04
Audit #06 — everything shipped since #05: the Security section's closing items (Access Control, Password Policy, API Tokens), Service Configuration, and Accounts. 5 issues found, all fixed the same day. 0 open.
2026-08-02
Audit #05 — everything shipped since #04: the release pipeline's first real-world test, trial-licensing reinstall protection, and a fresh look at the panel update mechanism's privilege boundary. 4 issues found, all fixed the same day. 0 open.
2026-08-01
Audit #04 — everything shipped since #03: FTP Settings, Backups, Login Security, Cron Jobs, and Licensing — the first pass to span three separate live servers, including our license server's entire history for the first time. 2 issues found on the license server, both fixed same day. 0 open.
2026-07-30
Audit #03 — everything shipped since #02 (~159 commits): Security Center, Packages & Resellers, KNJ Webmail, account creation/suspension, disk quota & bandwidth. 2 issues found, both fixed same day. 0 open.
2026-07-25
Audit #02 — the second server bring-up and everything unique to it. 1 informational note, no live exposure.
2026-07-25
Audit #01 — first full pass across everything built through the core provisioning loop, SSL, database, mail, and DNS management. 4 issues found, all fixed same day.