Security

If you've found a security problem in VorticPanel (the panel, its node agent, the installers) or in this website, please tell us privately first, and give us the chance to fix it before anyone else learns of it.

How to report it

Use the security form, or open a ticket in Security from your account. No account is needed for the form. Include what's affected and which version, the steps to reproduce it, and what someone could do with it. Screenshots, logs or a short proof of concept help.

What we ask

• Test only against a panel you run yourself, and against this website only as far as your own account goes.
• Don't look at, change or keep other people's data, and stop as soon as you've shown the problem.
• No denial-of-service testing, spam or social engineering of our staff or customers.
• Give us time to ship a fix before telling anyone else.

What happens next

You get an email saying your report arrived, and we keep you posted by email as we look into it. A fix goes out as a new release, and its release notes say what was fixed. Panels install it from Administration → Updates.

How releases are protected

Every release, and the node agent inside it, is signed. Panels check the signature and checksum before installing an update, nodes refuse an agent that isn't signed, and the one-command installer checks the release the same way. License leases are signed too, and a panel accepts only leases made for it.