Security model

MZPanel is designed so the customer VPS opens no inbound ports and the control plane never stores more secrets than it needs.

Three auth layers

Layer	From → to	Mechanism
A	User → dashboard	Session cookie (httpOnly, SameSite=Strict, Secure)
B	Dashboard → API	The same session cookie (same-origin / credentialed CORS)
C	Agent → API (WS)	Long-lived agent token, rotated when the license changes

The agent’s first contact uses a one-time install token (1-hour TTL); it swaps that for the long-lived agent token during registration.

Agent tokens & rotation

The install token is single-use and short-lived — safe to paste into a one-liner.
The long-lived agent token is rotated when your license changes.
Tokens authenticate the WebSocket; there is no inbound port to attack on the VPS.

Credential sealing (zero-knowledge)

When you store credentials for an external destination (e.g. an offsite backup target), MZPanel acts as a blind broker: it keeps only ciphertext. The plaintext is sealed client-side and the control plane cannot read it. See docs/17-credential-sealing.md.

Audit log

Every action on the control plane is recorded: who did it, when, the command, its exit code, and the log output. This is far more than shell history — it’s the system of record for everything done across your fleet.