// Knowledge base
Security model
How accounts are separated, and the sign-in controls on the panel.
Each hosting account runs in its own set of containers, on its own network. CPU and memory limits are set on each container. Each account's files are kept separate from every other account.
Administrators must use two-factor authentication, and it cannot be turned off. Resellers must use it as well. Forms in the panel use a CSRF token. Sign-in is limited to 15 attempts in 15 minutes. You can also restrict the admin area to a list of IP addresses.
Database passwords are encrypted at rest with AES-256-GCM. The panel talks to Docker through a proxy that only allows the calls it needs, on an internal network. Image builds and image patching through that proxy are turned off. Account containers use images that are already on the server.
Administrators manage the host firewall, Fail2Ban jails and banned addresses, and they can unban from the console. Clients can limit SFTP to an allow list, and they can turn off the file manager, Adminer, SFTP, cron or MariaDB.
Imports can scan files with ClamAV, when it is installed, and with PHP webshell checks. You can quarantine a hit or block the import.
SmashPanel has had internal code reviews. It has not had an independent security audit. To report a problem, use the disclosure policy.