Security
Found a vulnerability? Tell us privately.
PNLCS handles billing, customer credentials and payment integrations for real hosting businesses. A security defect can affect invoices, customer data and payments, and we treat every report that way.
Email [email protected]
Include a description, the affected component, steps to reproduce, the impact, and your PNLCS, Laravel, PHP and MySQL versions. Redact any credentials or customer data. A PGP key is available on request.
You can also use GitHub's private vulnerability reporting.Report on GitHub
Please do not open a public issue, discussion or forum thread for a security finding.
What happens after you report
- 48 hoursAcknowledgementYou hear back that the report arrived.
- 5 business daysTriageA first assessment and a severity rating.
- WeeklyStatus updatesSooner for critical issues.
- 14 daysFix releasedTypically, for critical issues, counted from confirmation.
- 90 daysDisclosureThe default window, negotiable.
In scope
- The application: admin area, client area, API, queue workers, scheduled jobs
- Authentication, roles, sessions and tokens
- Payment gateway, registrar and server integrations
- Templates and views in the built-in themes
- Install and upgrade scripts published from the repository
Out of scope
- Attacks that need physical or root-equivalent access
- Defects in third-party packages: please report them upstream
- Self-XSS, or missing headers without a real attack path
- Automated scanner output with no demonstrated impact
- The demo and sandbox installations run by Panelica
- Forks and modified copies
Built into every installation
What PNLCS does to keep an installation safe. The checklist covers what to check after installing.
Role-based access46 fine-grained permissions for staff. An API key acts with its staff account's role.
Two-factor authenticationFor staff and clients, with recovery codes for staff.
Rate limitingSign-in, two-factor codes, password resets and verification emails.
Activity logEvery action in the admin area and through the API is recorded with who did it.
Fenced hosting toolsEvery file, DNS, cron and backup action is checked against the customer's own domains.
Guarded provisioningOn Proxmox VE, PNLCS acts only on machines it created and marked.
Hall of fame
They reported a defect privately and gave us the time to ship a fix first. Thank you.
There is no paid bug bounty, but researchers are credited in the advisory and the changelog, and listed here if they wish. We will not pursue good-faith research that follows the policy.