Security
Privilege separation is the feature.
A hosting panel that is compromised can take the whole server with it. That shapes the architecture more than any part of the interface.
How the model works
No arbitrary command endpoint
There is no API that accepts a command string. Every privileged action is a named job with typed parameters and a fixed executable path.
Signed jobs over mTLS
The web process never runs as root. It hands signed, expiring jobs to the QuroAgent, which validates them against an allowlist.
Real tenant isolation
Separate Linux user, group, home, PHP-FPM pool, socket, temp directory and cgroup limits per account. No cross-account symlink escapes.
Secrets outside the database
Envelope encryption in OpenBao. Never in a queue payload, a log line or an AI prompt, and reveal-once in the interface.
Immutable audit
Actor, original actor during impersonation, resource, before and after, result and trace ID. Passwords and session tokens are never logged.
Transactional updates
Signature verified, backup taken, migration dry-run, atomic update, health check, automatic rollback on failure.
QuroPanel does not and will not claim to be unbreakable, and it will not assert a compliance certification it has not been audited for. The goal is to prevent, detect quickly, contain automatically, preserve evidence and recover.
Follow the build
The roadmap shows what is specified, what is being built and what is still only planned.
View the roadmapContribute
Drivers, integrations, translations and documentation are all places to start.
How to contributeReport a security issue
Responsible disclosure, with a stated response commitment.
Disclosure policy