Security Overview

1. DDoS protection.
   
2. Dedicated Firewall.
3. Encrypted backups.
   
4. Automated SSL/TLS.
5. App isolation & sandboxing.
6. Protection from XSS attacks.
7. Enforced HTTPS across all Apps.
8. Protection from App cookie hijacking.
9. Regular Security Patches & Speed Optimization.
10. All unused incoming & outgoing ports are disabled.
11. Applied Management Dashboard Password restrictions:
    - User passwords are required to have 1 uppercase, 1 number and 1 symbol.
    - User passwords must be at least 8 and at most 256 characters long.
    - Passwords are individually salted and hashed using PKBDF2.
12. Brute-force attacks protection:
    - Management Dashboard password verification routes - 10 requests per second per IP.
    - HTTP and HTTPS requests - 5000 requests per second per IP.
    - SSH and SFTP access - 5 connections per 10 seconds per IP.
    - Email access (Port 25, 465, 587, 993, 4190) - 50 connections per second per IP/App.
    - Database addons access - 5000 connections per second per app (addons use 128 byte passwords).
    - Email relay access - 500 connections per second per app.
    - Email receive access - 50 connections per second per app.
    - Auth addon access - 500 connections per second per app.
13. All Apps have a default Referrer-Policy of same-origin.
14. Apps can only connect to addons like databases, LDAP, email relay using authentication.
15. Apps run with a read-only rootfs preventing attacks where the application code can be tampered with.
16. Apps are run with an AppArmor profile that disables many system calls and restricts access to proc and sys filesystems.
17. Each App is run in it's own subdomain/domain as opposed to sub-paths.
    This ensures that XSS vulnerabilities in one app doesn't compromise
    other apps.

Various security related HTTP headers are applied like:
X-XSS-Protection, X-Download-Options, X-Content-Type-Options,
X-Permitted-Cross-Domain-Policies & X-Frame-Options.