Before the Software section’s multi-app installer, we paused for a full audit: everything shipped since #06, checked end to end before moving on. That covered ten sections of work, including SSL/TLS, Databases, package management, Packages & Resellers, the Email section, Domains, Files, Metrics, Team Access (the largest single authorization change of the project), and phpMyAdmin. The work was split across six focused review passes, a self-review of the phpMyAdmin sign-on design, a full git-history secret scan, and live-server state verification. Thirteen findings were fixed the same day.
Two are worth describing by class.
The first is credential handling. A few privileged actions, including two older ones that predated this window, passed a sensitive value in a way other local users could observe for as long as the command ran. This was confirmed on the development server, and all affected paths were moved onto private channels. The same class turned up again in the phpMyAdmin sign-on flow and was fixed the same way.
The second came within one line of being worse. An account-level API had drifted from the Team Access refactor, and the obvious one-line fix would have been incomplete: the permission needed to create an API token differs from the permission the API itself should require. Both halves went in together, with the missing permission check added. The lesson is that a token’s own ability is a ceiling, never a substitute for the underlying permission.
Also closed: missing ownership and session checks in reseller flows, stricter validation of archive contents and email headers, a missing permission check and input validation on DNS Lookup, an ambiguity in resolving accounts for users who own one account and collaborate on another, tighter limits on webhook destinations, and an explicit, short lifetime for phpMyAdmin access after a Team Access revocation.
Next: back to the Software section and the App Installer.