Security

Change the example admin password hash before using Admin. Use HTTPS, keep config.php private, avoid committing production leads or backups, and rotate credentials if a private file is exposed.

Before configuration exists, install.php provides the one-time browser setup and must be run immediately after upload to prevent first-visitor account claiming. It creates config.php with an exclusive write, hashes the password, and disables itself. Once configuration exists, it returns 404 unless both enable_install and a private setup_token open the read-only environment check. It never overwrites an existing config.

CSV exports intentionally exclude confirmation tokens, password data, IP hashes, mail logs, reports, and private backups.

Web-server boundary

Apache protections ship in the release. Other servers must deny direct access to config.php, all of storage/ (including MOD SQLite files), and executable extensions under uploads/. Verify these denials on the actual host; filesystem permissions alone are not a web access rule.

Trusted downloads and updates

Use only official downloads and the update controls provided in Admin. Keep the installed verification key in place, use HTTPS, and do not install packages whose integrity or compatibility checks fail.

MOD security

Official MODs are verified before installation. Packages that fail integrity, inventory, compatibility, dependency, conflict, or capability checks are rejected. License problems must never disable the free core or delete MOD data. Preserve the verification key included with the official release and replace it only through the trusted Admin workflow.

MODs can add stored data and third-party integrations. Back up storage/mods/ and read each MOD’s privacy and capability disclosure. Google reCAPTCHA, payment providers, and remote license/entitlement requests may transmit the limited installation or request data described by their configuration; in-house CAPTCHA keeps the challenge local.