Building a modern alternative to cPanel – looking for feedback from the LET community

timmmy · March 22

@HPanel said:

@hostkar said:
And looks like you are using WHMCS. And if it so then it's nulled.

The store is currently running on a WHMCS development license while we finalize our setup. It's not a nulled copy. We're transitioning to a licensed production instance. We're actually moving to our own billing platform within the next week WHMCS is being phased out entirely.

also running dev license?

lichade · March 22

@gunarath said:

@forest said:

@gunarath said: You can’t really make that kind of conclusion without a proper review. Looking at what they’ve built vs what’s missing (which seems relatively small), it’s not fair to assume those gaps can’t be fixed.

What about demonstrating an RCE in mere minutes?

This is more of a general problem with JS SSR frameworks. It’s not that Next.js or Express can’t be secure, but in practice it’s much harder to do it properly. Developers have less control compared to something like Go or Rust, especially around isolation and request handling.

But this isn’t some impossible issue. we can fix most of it with a proper BFF or gateway layer. even if there are 300+ endpoints. It can actually improve performance too.

I’m here more because I’m interested in a new cPanel alternative. CloudLinux is still built around older kernel assumptions, and cPanel is slowly becoming a monopoly. This project actually has a better architecture direction, so it makes more sense to help make it secure rather than just ignore it.

as far as i can tell, its a SPA with a node express api server. dont know where you got JS ssr from 💀
usually i wouldnt make random accusations of AI, but this seems like something that AI would hallucinate to explain a vulnerability.
and also, the vulnerability was from executing a shell command of concat ing bin & user input. using another language would not have prevented it. it was a logic error, nothing to do with the language.

HPanel · March 22

@lichade said:

@gunarath said:

@forest said:

@gunarath said: You can’t really make that kind of conclusion without a proper review. Looking at what they’ve built vs what’s missing (which seems relatively small), it’s not fair to assume those gaps can’t be fixed.

What about demonstrating an RCE in mere minutes?

This is more of a general problem with JS SSR frameworks. It’s not that Next.js or Express can’t be secure, but in practice it’s much harder to do it properly. Developers have less control compared to something like Go or Rust, especially around isolation and request handling.

But this isn’t some impossible issue. we can fix most of it with a proper BFF or gateway layer. even if there are 300+ endpoints. It can actually improve performance too.

I’m here more because I’m interested in a new cPanel alternative. CloudLinux is still built around older kernel assumptions, and cPanel is slowly becoming a monopoly. This project actually has a better architecture direction, so it makes more sense to help make it secure rather than just ignore it.

as far as i can tell, its a SPA with a node express api server. dont know where you got JS ssr from 💀
usually i wouldnt make random accusations of AI, but this seems like something that AI would hallucinate to explain a vulnerability.
and also, the vulnerability was from executing a shell command of concat ing bin & user input. using another language would not have prevented it. it was a logic error, nothing to do with the language.

Thanks to everyone who took the time to test and report issues it’s genuinely appreciated.

All previously identified vulnerabilities have now been addressed, including input validation gaps and unsafe command execution paths. Additional checks and safeguards have been implemented across both route-level and execution layers.

If anyone would like to continue testing or attempt further audits, you’re more than welcome any additional findings are appreciated and will be reviewed promptly.

Appreciate the feedback and effort from the community 👍

ailice · March 22

Many sloppies comment make this more funny, use ssr but vuln was input not sanitize, how is that require your to prompt the answer xD

Alyx · March 22

@HPanel said:

@forest said:

@HPanel said:
No system is immune to vulnerabilities even mature panels like cPanel or DirectAdmin regularly patch security issues.

The important part is identifying, fixing, and continuously improving which is exactly what this early feedback phase is for.

You're selling a product that a bored guy on a forum for cheap VPSes was able to fully compromise. You are in way over your head. There is a difference between "nothing is perfectly secure" and "randos on a forum for cheap hosting can break into it with ease". Before "continuously improving" comes "learning how to program".

You are only doing more damage to your brand by staying here.

I get where you're coming from the initial issues were real and already acknowledged.

But let’s be clear: this thread was posted specifically to find problems early

Pointing out vulnerabilities is useful repeating the same narrative after fixes, or turning it into personal remarks, isn’t.

If there are still concrete issues, I’m open to hearing them. Otherwise, I’ll focus on continuing to improve the system rather than going in circles here.

So I understand you correct?
You let your AI write some program so you can make money selling it, but we should be the idiots to make it secure for you?

forest · March 22

@HPanel said: Pointing out vulnerabilities is useful repeating the same narrative after fixes, or turning it into personal remarks, isn’t.

If there are still concrete issues, I’m open to hearing them. Otherwise, I’ll focus on continuing to improve the system rather than going in circles here.

This is almost the exact line used by the last AI slop peddler who got laughed off the forum and ended up throwing a fit. You can't continue to improve something if you don't even understand what you wrote.

@HPanel said: Appreciate the feedback and effort from the community 👍

You aren't getting feedback the way you think you are. You are getting mocked and hacked while you still believe it's smart to start gearing up for production.

@Alyx said: You let your AI write some program so you can make money selling it, but we should be the idiots to make it secure for you?

I doubt he even means that. It's probably just nonsense the AI hallucinated. I'm pretty sure he genuinely believed that his product was secure and nearing a production-ready state, given the fact that he's planning to start selling it "next week".

gunarath · March 22

@lichade said:

@gunarath said:

@forest said:

@gunarath said: You can’t really make that kind of conclusion without a proper review. Looking at what they’ve built vs what’s missing (which seems relatively small), it’s not fair to assume those gaps can’t be fixed.

What about demonstrating an RCE in mere minutes?

This is more of a general problem with JS SSR frameworks. It’s not that Next.js or Express can’t be secure, but in practice it’s much harder to do it properly. Developers have less control compared to something like Go or Rust, especially around isolation and request handling.

But this isn’t some impossible issue. we can fix most of it with a proper BFF or gateway layer. even if there are 300+ endpoints. It can actually improve performance too.

I’m here more because I’m interested in a new cPanel alternative. CloudLinux is still built around older kernel assumptions, and cPanel is slowly becoming a monopoly. This project actually has a better architecture direction, so it makes more sense to help make it secure rather than just ignore it.

as far as i can tell, its a SPA with a node express api server. dont know where you got JS ssr from 💀
usually i wouldnt make random accusations of AI, but this seems like something that AI would hallucinate to explain a vulnerability.
and also, the vulnerability was from executing a shell command of concat ing bin & user input. using another language would not have prevented it. it was a logic error, nothing to do with the language.

Looks like you’re correct, I actually checked the response from the server now

So yeah, this isn’t SSR.

If this is Express API server, then the issue people found is actually more critical than I first thought. We can’t blame SSR here. And honestly, even nowadays AI is capable of implementing proper input validation, so this looks more like a basic logic mistake than anything else.

lichade · March 22

@gunarath said:

@forest said:

@gunarath said:

@forest said:

@gunarath said: Your stack is solid overall, especially the isolation with cgroups v2 and per user PHP-FPM. The lightweight footprint is also a big plus.

Solid, except vulnerable to remote code execution.

@gunarath said: If you want, I can help design a clean BFF and SSR validation flow for this.

Are... are you joking right now? Did you really just post an AI's reply directly without even removing that final tell? You know pure AI content without humans is not allowed here, right?

No, I’m not joking. I wrote that and used AI to clean up the wording since my English is not that good. The main point still stands.

I mostly work with Go and Rust on backend systems where isolation and security really matter. If you’re interested, I’m happy to help think through a proper BFF layer and SSR boundary with stronger validation and request isolation.

"If you want, I can help design a clean BFF and SSR validation flow for this." is not AI translating for you. That's AI copy-paste. Anyway, the AI was wrong in its analysis: the code is insecure garbage.

Maybe you haven’t fully checked the demo.

From what I’ve seen so far after going through the panel and structure, the system actually has a decent design and covers most of the required functionality.

From my perspective, the main concern is more about using JS for the backend in this context, not that the entire system is insecure garbage.

You can’t really make that kind of conclusion without a proper review. Looking at what they’ve built vs what’s missing (which seems relatively small), it’s not fair to assume those gaps can’t be fixed.

so did you really go through the "panel and structure" or did AI hallucinate that too?

gunarath · March 22

@lichade said:
so did you really go through the "panel and structure" or did AI hallucinate that too?

I don’t need to go through all that **.

Also, it’s bad practice to store things like roles in localStorage. unless if you have proper server side validation, it’s still unnecessary exposure. I mentioned it because I actually want this project to succeed.

{"id":1,"username":"admin","email":"[email protected]","first_name":"Admin","last_name":"User","role":"admin","status":"active","two_factor_enabled":false,"last_login":"2026-03-22T08:09:56.973Z","last_login_ip":"112.134.225.36","created_at":"2026-03-14T09:57:40.458Z","permissions":[]}

HPanel · March 22

@gunarath said:

@lichade said:
so did you really go through the "panel and structure" or did AI hallucinate that too?

I don’t need to go through all that **.

Also, it’s bad practice to store things like roles in localStorage. unless if you have proper server side validation, it’s still unnecessary exposure. I mentioned it because I actually want this project to succeed.

{"id":1,"username":"admin","email":"[email protected]","first_name":"Admin","last_name":"User","role":"admin","status":"active","two_factor_enabled":false,"last_login":"2026-03-22T08:09:56.973Z","last_login_ip":"112.134.225.36","created_at":"2026-03-14T09:57:40.458Z","permissions":[]}

Good point regarding localStorage but just to clarify how it's implemented here:

The role stored in localStorage is only used for UI rendering (e.g. showing admin menus). Actual authorization is handled entirely on the backend.

Each request is verified using JWT (which only contains userId), and the role is fetched fresh from the database on every request. So modifying localStorage does not grant any additional privileges.

That said, I agree that storing unnecessary fields like last_login_ip on the client side isn't ideal and will be cleaned up to reduce exposure.

Appreciate the feedback this is exactly the kind of input that helps improve things.

Alyx · March 22

@HPanel said: Appreciate the feedback this is exactly the kind of input that helps improve things.

Since we are expected to be your red team, are we getting paid for it?

gunarath · March 22

@HPanel said:
Appreciate the feedback this is exactly the kind of input that helps improve things.

If you want to improve this further, it’s better to move toward an in memory cache instead of hitting the DB on every request. You can still keep strong security, but you need to make sure things like token blacklists and role/permission changes are properly and atomically synced across memory.

If that part is handled correctly, you can achieve both performance and security without checking the database for every request.

HPanel · March 22

@gunarath said:

@HPanel said:
Appreciate the feedback this is exactly the kind of input that helps improve things.

If you want to improve this further, it’s better to move toward an in memory cache instead of hitting the DB on every request. You can still keep strong security, but you need to make sure things like token blacklists and role/permission changes are properly and atomically synced across memory.

If that part is handled correctly, you can achieve both performance and security without checking the database for every request.

You're absolutely right about the performance impact of DB queries on every request. I agree that moving to an in-memory cache with proper cache invalidation would give us both security and performance. will be implement thanks for your support

plumberg · March 22

I get thr idea to source feedback from community. But here it simply reads like

I have made a new system
find vulnerabilities
I will fix
its a secure system now

If you really cared about security you would have attempted to get your code audited by a third party that specializes it something like this. You are talking about a web hosting panel, competing the likes of CPanel/ DA and security should be paramount ask rather than sloppy features that are nice on paper to sell but usage is typically low once initial setup is done.

Majority of this community, has technical acumen of a mustard seed, it can not and should not be used to find bugs.

@HPanel you should definitely not deflect the point so many have already made about vibe coding this panel. Acknowledge it and understand its workings. Do not blindly rely on AI. Hallucinations are a big reason why there are security lapses which lead to malicious actors exploit vulnerabilities. This just increases the blast radius once you have production clients.

But yes, this is NOT the right place until you have your i's dotted and t's crossed.

You are simply doing more harm in the longterm to your reputation.

PS: Yes, the community is knowledgeable and savvy but not everyone commenting here is having the ability to understand the codebase / workings including me.
But I know when to point out when folks which are smarter needed

Levi · March 22

Without valid third party security audit this will be limited to low end plankton. Not even close to be useable for business.

Team size of developers?
SLA?
Software built to vendor lock-in customers.

When panel use modular approach of some software, it can be replicated with another software. For example: litespeed used in cpanel and da. Maldet and mod_sec used in cpanel and da. This is advantage, not problem.

So called hpanel tries to invent wheel and vendor lock-in potential customer. Deceptive practice and wrong angle to attract business.

Zhenmue · March 22

@gunarath said:

@lichade said:

@gunarath said:

@forest said:

@gunarath said: You can’t really make that kind of conclusion without a proper review. Looking at what they’ve built vs what’s missing (which seems relatively small), it’s not fair to assume those gaps can’t be fixed.

What about demonstrating an RCE in mere minutes?

This is more of a general problem with JS SSR frameworks. It’s not that Next.js or Express can’t be secure, but in practice it’s much harder to do it properly. Developers have less control compared to something like Go or Rust, especially around isolation and request handling.

But this isn’t some impossible issue. we can fix most of it with a proper BFF or gateway layer. even if there are 300+ endpoints. It can actually improve performance too.

I’m here more because I’m interested in a new cPanel alternative. CloudLinux is still built around older kernel assumptions, and cPanel is slowly becoming a monopoly. This project actually has a better architecture direction, so it makes more sense to help make it secure rather than just ignore it.

as far as i can tell, its a SPA with a node express api server. dont know where you got JS ssr from 💀
usually i wouldnt make random accusations of AI, but this seems like something that AI would hallucinate to explain a vulnerability.
and also, the vulnerability was from executing a shell command of concat ing bin & user input. using another language would not have prevented it. it was a logic error, nothing to do with the language.

Looks like you’re correct, I actually checked the response from the server now

So yeah, this isn’t SSR.

If this is Express API server, then the issue people found is actually more critical than I first thought. We can’t blame SSR here. And honestly, even nowadays AI is capable of implementing proper input validation, so this looks more like a basic logic mistake than anything else.

that happens, when you use an AI chatbot, to reply on a forum, instead of replying by yourself.

gunarath · March 22

[@Zhenmue said]
that happens, when you use an AI chatbot, to reply on a forum, instead of replying by yourself.

That’s not the fault of the bots, I’m the one who said it was SSR. I said that because I’ve seen similar server side validation issues more often in JS SSR apps in my experience, and I already have a bias against that stack.

zed · March 22

Can anyone link the 2 previous threads for comparison/humor?

HOSTCAY · March 22

I laughed a little when I was able to reboot the demo from restart server section. Perhaps disable that function.

Levi · March 22

@HOSTCAY said:
I laughed a little when I was able to reboot the demo from restart server section. Perhaps disable that function.

Loop it, it worth thousand words.

HOSTCAY · March 22

@Levi said:

@HOSTCAY said:
I laughed a little when I was able to reboot the demo from restart server section. Perhaps disable that function.

Loop it, it worth thousand words.

It’s also where iHostARTs website is hosted too 😂

HPanel · March 22

@HOSTCAY said:
I laughed a little when I was able to reboot the demo from restart server section. Perhaps disable that function.

i open all these functions for testing

sanchogodinho · March 22

Please add support for Bun!

HOSTCAY · March 22

@HPanel said:

@HOSTCAY said:
I laughed a little when I was able to reboot the demo from restart server section. Perhaps disable that function.

i open all these functions for testing

Please open Terminal too for testing please

timmmy · March 22

hpanel = highrisk panel

ascicode · March 22

CREMS CHOCOLATES LTD 15347882 dissolved march 2025
SYED PRINTS LTD 13638687 dissolved march 2023
HOSTLIC LTD 12623752 dissolved july 2022
KTDL GLOBAL TRADE LTD 15375353 dissolved june 2025
HOSTLIC LTD 14252800 dissolved december 2024
SWIFTTRON LTD 12711071 dissolvdd december 2021
ALICRATE LIMITED 12803212 dissolved january 2022
Can guess MINSA PIVATE LIMITED is same person.

HOSTLIC WEBHOSTING LTD 16074397
Gone soon?

Someone is really unsure what to do with his life.

Obelous · March 22

@ascicode said:
CREMS CHOCOLATES LTD 15347882 dissolved march 2025
SYED PRINTS LTD 13638687 dissolved march 2023
HOSTLIC LTD 12623752 dissolved july 2022
KTDL GLOBAL TRADE LTD 15375353 dissolved june 2025
HOSTLIC LTD 14252800 dissolved december 2024
SWIFTTRON LTD 12711071 dissolvdd december 2021
ALICRATE LIMITED 12803212 dissolved january 2022
Can guess MINSA PIVATE LIMITED is same person.

HOSTLIC WEBHOSTING LTD 16074397
Gone soon?

Someone is really unsure what to do with his life.

With this love of registering companies I'm surprised he hasn't registered HPANEL LTD too.

Alyx · March 22

Damn.. this is sad news, I would have bought the chocolate :c

doghouch · March 22

I just went to the backups page, entered | service nginx stop as a hostname, and clicked on "test connection."

Andru · March 22

@doghouch said:
I just went to the backups page, entered | service nginx stop as a hostname, and clicked on "test connection."

LOL

Howdy, Stranger!

Categories

In this Discussion

Building a modern alternative to cPanel – looking for feedback from the LET community

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Building a modern alternative to cPanel – looking for feedback from the LET community

Comments