Security at Sahaab

In the product

• Every account runs isolated, with its own system user, resource limits and file permissions.
• Passwords are stored only as hashes; stored secrets (API keys, remote storage credentials) are encrypted on the server.
• Two-factor sign-in, brute-force protection, a firewall, a web application firewall and a malware scanner are included.
• Updates are downloaded over HTTPS and checked against their published checksum before they are installed; a snapshot of the panel is taken before every update, and fixes can install themselves at night.
• Error reports that panels send us contain no customer data: domains, addresses, account names and secrets are removed before anything leaves the server, and the reports can be switched off.

Reporting a vulnerability

If you believe you have found a security problem in Sahaab or on our websites, please email [email protected] with the steps to reproduce it. Please do not test against servers you do not own, and give us a reasonable time to fix the issue before disclosing it. We will confirm receipt within two business days and keep you informed.

Payments

Payments on this website are handled by Stripe. Card details are entered on Stripe's secure pages and never reach our servers.