KNJ Panel · Security
Independent audits, run as we build
Every audit below runs against the actual live dev build, not a cleaned-up snapshot before release. We publish what each pass covers and what it found — including the things that needed fixing — with no code and no private server details. That's the point: you can see this is a habit, not a one-time checklist before launch.
5
Audits run
0
Open critical issues
4
Found & fixed same day
31
Commits covered, latest pass
Latest audit: #05 · 2026-08-02 · scope: everything shipped since #04 — the release pipeline's first real-world test, trial-licensing protection, and a fresh look at the update mechanism's privilege boundary
Update Mechanism — Privilege Boundary
A system permission behind the panel's own update button was scoped more loosely than it needed to be — only exploitable if the application itself were already compromised, but that's exactly the boundary meant to hold regardless. Tightened, and verified the legitimate path still works exactly as before.
1 permission tightened · verified live
Trial Licensing — Reinstall Protection
The check meant to stop a wiped-and-reinstalled server claiming an unlimited string of free trials wasn't actually able to read the one signal it needed to work. Fixed, and proven for real: a genuine reinstall now resumes the same trial with days remaining, or locks cleanly to a purchase prompt if it's actually expired.
1 issue found · fixed and proven live
Deployment Tooling — Self-Modifying Scripts
Two of our own internal deployment scripts each tried to update their own installed copy while running — one silently failed to take effect, the other crashed outright the moment it was tested for real. Neither touches a customer install. Both now run as a permanent stub that always executes the current version fresh, removing the whole class of problem rather than patching around it.
2 scripts redesigned · 0 customer impact
Self-Service Profile Changes
The new self-service password and email change page, checked end to end — current-password confirmation required for every password change, no new surface introduced.
0 findings
Release Pipeline — First Real-World Test
Every release we've ever published, checked directly against what actually shipped inside it, not just the process that builds them.
9 releases inspected · 0 leaks
Live Server & Deployment Verification
Every server in our estate — now four, including a disposable test box added this week — checked against what it was actually running, not what we assumed had deployed. Every automated test across every server passing before and after.
4 servers, 700 tests · 0 drift
Secrets & Credential Handling
Full commit history of every repository with activity since the last audit, scanned for anything that should never have been committed.
5 repos, full history · 0 findings
Audit history
The full write-up for each pass stays in our private engineering log — this is the shape of what we share publicly: what was covered, what came of it, nothing more.
2026-08-02
Audit #05 — everything shipped since #04: the release pipeline's first real-world test, trial-licensing reinstall protection, and a fresh look at the panel update mechanism's privilege boundary. 4 issues found, all fixed the same day. 0 open.
2026-08-01
Audit #04 — everything shipped since #03: FTP Settings, Backups, Login Security, Cron Jobs, and Licensing — the first pass to span three separate live servers, including our license server's entire history for the first time. 2 issues found on the license server, both fixed same day. 0 open.
2026-07-30
Audit #03 — everything shipped since #02 (~159 commits): Security Center, Packages & Resellers, KNJ Webmail, account creation/suspension, disk quota & bandwidth. 2 issues found, both fixed same day. 0 open.
2026-07-25
Audit #02 — the second server bring-up and everything unique to it. 1 informational note, no live exposure.
2026-07-25
Audit #01 — first full pass across everything built through the core provisioning loop, SSL, database, mail, and DNS management. 4 issues found, all fixed same day.