Security

Change the example admin password hash before using Admin. Use HTTPS, keep config.php private, avoid committing production leads or backups, and rotate credentials if a private file is exposed.

Before configuration exists, install.php provides the one-time browser setup and must be run immediately after upload to prevent first-visitor account claiming. It creates config.php with an exclusive write, hashes the password, and disables itself. Once configuration exists, it returns 404 unless both enable_install and a private setup_token open the read-only environment check. It never overwrites an existing config.

CSV exports intentionally exclude confirmation tokens, password data, IP hashes, mail logs, reports, and private backups.

Web-server boundary

Apache protections ship in the release. Other servers must deny direct access to config.php, all of storage/ (including MOD SQLite files), and executable extensions under uploads/. Verify these denials on the actual host; filesystem permissions alone are not a web access rule.

Private Home Base boundary

Owner-only Home Base tools use separate authorization, password hashing, CSRF checks, secure sessions, HTTPS enforcement, throttling, POST logout, audit logging, and private SQLite storage. Home Base modules are disabled unless explicitly configured and are blocked from release ZIPs by automated gates. Private signing keys, payment secrets, customer records, release databases, and unpublished MOD source must never enter a public artifact.

MOD security

Official MODs must be signed by Home Base and verified locally before staging. Unsigned, tampered, traversal, symlink, unexpected-inventory, incompatible, conflicting, or undeclared-capability packages are rejected. License problems must never disable the free core or delete MOD data. Preserve keys/mod-signing-public.pem; never substitute a key received through an untrusted channel.

MODs can add stored data and third-party integrations. Back up storage/mods/ and read each MOD’s privacy and capability disclosure. Google reCAPTCHA, payment providers, and remote license/entitlement requests may transmit the limited installation or request data described by their configuration; in-house CAPTCHA keeps the challenge local.