KNJ Panel · Security
Independent audits, run as we build
Every audit below runs against the actual live dev build, not a cleaned-up snapshot before release. We publish what each pass covers and what it found — including the things that needed fixing — with no code and no private server details. That's the point: you can see this is a habit, not a one-time checklist before launch.
21
Audits run
0
Open critical issues
223
Found & fixed same day, all-time
3
Issues found, latest audit (#21)
73
Commits covered, latest pass
Audit #21: 3 issues found and fixed — the smallest count in this run of sweeps yet — with five of eight categories, including the cross-account access check for a fifth pass running, coming back completely clean.
Latest audit: #21 · 2026-08-27 · scope: the seventh in a run of exhaustive, bug-class-organized sweeps across the whole codebase rather than a diff since the last pass — interrupted partway through by a personal usage-limit reset, picked back up a few hours later with no code left in a broken state. 3 issues found and fixed, five of the eight sweep categories came back completely clean, and the cross-account access check came back clean for a fifth pass running
Two Clicks, One Domain, Two Certificates
Clicking "Retry" on a failed certificate twice in quick succession — an easy thing to do on a slow page — could kick off two overlapping certificate requests for the same domain at once, instead of the second click safely waiting its turn the way every other retry action in the panel already does. Fixed with the same one-at-a-time safeguard used everywhere else.
1 action, now serialized
A Save That Could Get Quietly Undone
Three background processes that occasionally rebuild the server's shared web-server configuration each read the current settings, then asked to make their change — instead of both happening as one uninterruptible step. If an admin saved a genuinely new setting in the narrow gap between those two moments, one of the background rebuilds could silently overwrite it with the old value: the admin screen kept showing the new setting as saved, but the live configuration didn't match. Fixed by making the read and the write one atomic step.
3 code paths, now synchronized
An App Install That Could Go Quiet Forever
If the background process installing a new application got killed at exactly the wrong moment — a server restart, an out-of-memory event — the install could get stuck showing "in progress" indefinitely with nothing telling an admin it needed attention. An earlier pass had correctly left this one un-auto-fixed, since a careless fix here risked silently deleting half-created resources — but never gave it the admin alert its safer siblings already get. Closed properly this time: an admin now gets alerted without anything being auto-deleted or guessed at.
1 gap, now alerted
The Question That Matters Most, Clean for a Fifth Time
Every account-side and admin-side action that touches a specific customer's data was independently re-checked from scratch for whether one customer could ever reach another's resources by guessing an ID or forging a request. Nothing found — the fifth consecutive pass to come back clean on this exact question.
5 consecutive clean passes
Audit history
The full write-up for each pass stays in our private engineering log — this is the shape of what we share publicly: what was covered, what came of it, nothing more.
2026-08-27
Audit #21 — the smallest pass in this run of exhaustive, bug-class-organized sweeps across the whole codebase — the seventh confirmation pass using this technique, interrupted partway through by a personal usage-limit reset and picked back up a few hours later with no code left in a broken state. 3 issues found and fixed: a certificate-retry button missing the same one-at-a-time safeguard every other retry action already has, a narrow window where a background configuration rebuild could quietly undo an admin's just-saved setting, and an app-install failure case that had correctly been left un-auto-fixed by an earlier pass but never given the admin alert its safer sibling gets. Five of the eight sweep categories came back completely clean, including the cross-account access check for a fifth pass running. Full test suite (2,446 tests, up from 2,440) re-run clean. 0 open.
2026-08-27
Audit #20 — the biggest sweep yet in this series — roughly 65 issues found, collapsing to about a dozen real underlying causes once traced back, three of them wide-reaching enough that fixing the shared root cause closed somewhere between a dozen and nineteen separate symptoms each in one move, a meaningfully different shape of progress than earlier rounds' one-file-at-a-time fixes. The most serious: a background helper script that ran a privileged system command but never actually checked whether it succeeded — an entire class of 'this quietly failed' risk an earlier design had assumed was only theoretical turned out, in the real code, to be guaranteed to go undetected every time it happened. That finding fed directly into a deliberate, from-scratch redesign of account removal: it no longer deletes anything until the real system-level teardown is confirmed to have actually succeeded, and a failed removal now shows clearly in the admin dashboard with a retry option, instead of the database quietly disagreeing with reality. The cross-account access check came back clean for a fourth pass running. Full test suite (2,440 tests, up from 2,343) re-run clean. 0 open.
2026-08-27
Audit #19 — a fresh morning's re-run of the same eight-category technique against the previous pass's own fixes, explicitly testing whether two passes in a row could come back clean. They couldn't — but every one of the roughly 24 issues found was the same shape as something already fixed in an earlier pass, just in one more file, not a newly discovered kind of bug. Included two more unlocked concurrency windows and a background-alert wiring gap traced back to a decision made two commits into an earlier fixing session — but the most notable was a real permission bypass, reported independently by a second review running the same technique in parallel and cross-checked before being folded in: an action correctly blocked by the ordinary admin interface but not by its own API twin, letting a permission an admin had explicitly revoked keep working through the back door. The cross-account access check came back clean for a fourth pass running, and one reviewer caught and openly retracted its own false-positive finding before it reached a fix queue. Full test suite (2,343 tests, up from 2,302) re-run clean. 0 open.
2026-08-26
Audit #18 — an evening confirmation pass that turned up the most severe individual finding of this whole run: a password-change action for a file-access feature that persisted the new password to the database and reported success, but the actual system-level file write it depended on had no check on whether it worked at all — a disk-full or permissions failure meant the account owner believed their password had changed while the real access credential silently kept the old one, with nothing anywhere signaling anything was wrong. Also found: the same file-locking gap already fixed once, propagated into six more files outside that fix's original scope; roughly 30 more sites where a real safety net existed but surfaced a raw error page instead of a friendly message when two people acted at the same moment; and about 15 more places where one method in a file had a safeguard its neighbor in the same file didn't. Full test suite (2,302 tests, up from 2,230) re-run clean. 0 open.
2026-08-26
Audit #17 — a same-day confirmation pass against the previous audit's own fixes, which surfaced a real propagation gap: the exact 'stop two people acting at once' fix applied to one background action had never been copied to nine other actions with the identical shape. Also found and closed: a cross-feature naming collision that could let two different account features silently claim the same address at once, four background configuration-rebuild processes missing the same one-at-a-time protection, a missing uniqueness check on server registration, a small pagination bug in the new calendar-sync feature, and one gap in the safety net built in the previous audit, found by testing it against a case it hadn't been extended to yet. Full test suite (2,230 tests, up from 2,197) re-run clean. 0 open.
2026-08-26
Audit #16 — a deliberate methodology change, triggered by the previous audit's own finding that its detection technique had a structural blind spot — instead of reviewing one feature area at a time, seven parallel passes each swept the entire codebase for one specific bug shape and checked every match fresh. The most serious finding: a self-service backup-restore upload accepted an archive containing a symbolic link, which a crafted upload could use to write a file onto a completely different customer's website — fixed with the same archive-safety check already used everywhere else archives are extracted, just never applied to this one unprivileged path. Also found and fixed: a webmail pagination bug that silently skipped one message every time a customer turned the page, a missing safety lock on account backup/restore that let two near-simultaneous requests corrupt each other's output, and nine more instances of a background job silently getting stuck instead of failing visibly when a privileged operation timed out. A same-day follow-up built a general safety net for that last category — any background job now gets automatically marked failed and flagged for an admin, rather than sitting stuck forever, if the process running it gets killed outright rather than failing on its own. Full test suite (2,197 tests, up from 2,153) re-run clean. 0 open.
2026-08-25
Audit #15 — a pre-production readiness sweep, the first scoped explicitly to "are we ready to move off the current setup" rather than just a diff since the last pass — everything shipped since #14 (a web application firewall, calendar and contact syncing, and several mail-security features) plus, for the first time, a full compromise check across every server we currently operate, not only the one we build on. 7 issues found and fixed, the most notable a spelling mismatch that meant a virus-scanning toggle had silently never actually turned on since the day it shipped, while the on-screen status kept reading as enabled. Also closed: the new calendar-sync feature missing the same brute-force logging every other login already has, a spreadsheet-formula injection risk in a new export feature, and four smaller consistency gaps matching this project's own established patterns. The full-fleet check found zero signs of unauthorized access anywhere. Full test suite (1,914 tests, up from 1,907) re-run clean. 0 open.
2026-08-22
Audit #14 — the second audit in a row scoped to one whole piece of the system rather than a diff since the last pass: the Mail Only satellite role, reviewed end to end — role gating, the command channel between the main server and a linked satellite, every mail-related action in the install script, authorization across every mail-touching feature, and the cross-server admin login plus webmail session handling. 4 issues found and fixed, the most serious a command channel that checked who was sending a command but not what commands it would accept — closed with an explicit allowlist of the exact 33 commands that channel is meant to carry. Also closed: a licensing guard that covered one limited-purpose server type but not its twin, one login form missing the same brute-force protection every other login already has, and two install-script checks tightened to rule out a path-traversal shape by construction rather than by hoping it never appears. Cross-account authorization across every mail feature came back fully clean. Full test suite (1,693 tests) re-run clean. 0 open.
2026-08-22
Audit #13 — the first audit in this series scoped to one whole piece of the system rather than a diff since the last pass: the DNS-only satellite role, reviewed end to end — role gating, server-to-server sync in both directions, the trust-establishment flow, and the privileged install script's actions for that role. 4 issues found and fixed, the most serious a fallback connection path that, if intercepted once during a narrow bootstrap window, could leave a permanent address redirect behind — closed by narrowing which connection a self-reported address update is trusted from, without touching the underlying design question already flagged as open two audits ago. Also closed: a whole panel area relying on two facts holding forever instead of checking directly (not currently exploitable, added anyway), and two small consistency cleanups. Full test suite (1,688 tests) re-run clean. 0 open.
2026-08-22
Audit #12 — everything shipped since #11 — 112 commits, the largest single window this project has covered: the DNS-only role's remaining buildout, the first-run setup wizard, the two-key mutual-auth server linking system, and the full Mail Only satellite-server epic. Reviewed as five parallel passes rather than one linear read. 5 issues found and fixed, the most serious a step-ordering gap in the setup wizard that could have permanently locked a fresh install out of ever creating an admin account — closed by checking the real invariant (does an admin exist) rather than a session flag that didn't guarantee it. Also closed: the same gap made it possible to register a forged server-trust record before any admin existed; a signing key reused for two different purposes in the cross-server login feature, now domain-separated; and a setup-link expiry whose first implementation was silently broken by a date-library behaviour change, caught by the test suite before it ever shipped. Full test suite (1,683 tests) re-run clean. 0 open.
2026-08-17
Audit #11 — a pre-release "check every line" pass, ordered before the audit itself: fix everything found, then run the audit clean. Dedicated sweeps covered every controller, the whole services layer, all 182 views, all 62 models, and the full ~6,000-line provisioning script line by line. 14 issues found and fixed — the largest was one root-run symlink-safety bug class (11 instances, found by re-sweeping the whole script after the first two turned up) — plus config injection via a File Manager folder name, several passwords briefly visible via the server's process list, and two access tokens moved from plaintext to encrypted storage. Full test suite (1,414 tests) re-run clean, every fix live-verified on the real server, and the audit re-run afterward found 0 new issues. 0 open.
2026-08-14
Audit #10 — a targeted review of everything shipped since #09: Server-Side Cron Jobs, real AWStats, Feature Manager, SSL/TLS, self-service Perl Modules, and Upgrade Database Version — the highest-risk addition this window. Secret scan across all three repos clean; every new route's actual middleware chain checked directly. The database upgrade tool was genuinely live-tested on a disposable server built for exactly that, which found and fixed one real bug before it could ever reach a live customer install. 0 issues open.
2026-08-12
Audit #09 — a 5-day break, then a full intrusion-detection sweep instead of a code review — no new commits in scope. Every server's complete login history traced, every access control tested live, one database restart investigated and explained. 0 issues found, 0 open.
2026-08-07
Audit #08 — everything shipped since #07: the App Installer's rebuild into a five-app catalog (WordPress, Drupal, Nextcloud, MediaWiki, phpBB). 3 issues found, all fixed the same day. 0 open.
2026-08-06
Audit #07 — everything shipped since #06: SSL/TLS, Databases, OS package management, Packages & Resellers, Server Configuration, the full Email section, Domains, Files, account-side Databases, Metrics, DNS Lookup, Team Access, and real phpMyAdmin. 13 issues found, all fixed the same day. 0 open.
2026-08-04
Audit #06 — everything shipped since #05: the Security section's closing items (Access Control, Password Policy, API Tokens), Service Configuration, and Accounts. 5 issues found, all fixed the same day. 0 open.
2026-08-02
Audit #05 — everything shipped since #04: the release pipeline's first real-world test, trial-licensing reinstall protection, and a fresh look at the panel update mechanism's privilege boundary. 4 issues found, all fixed the same day. 0 open.
2026-08-01
Audit #04 — everything shipped since #03: FTP Settings, Backups, Login Security, Cron Jobs, and Licensing — the first pass to span three separate live servers, including our license server's entire history for the first time. 2 issues found on the license server, both fixed same day. 0 open.
2026-07-30
Audit #03 — everything shipped since #02 (~159 commits): Security Center, Packages & Resellers, KNJ Webmail, account creation/suspension, disk quota & bandwidth. 2 issues found, both fixed same day. 0 open.
2026-07-25
Audit #02 — the second server bring-up and everything unique to it. 1 informational note, no live exposure.
2026-07-25
Audit #01 — first full pass across everything built through the core provisioning loop, SSL, database, mail, and DNS management. 4 issues found, all fixed same day.