The panel needs the Docker socket, which is equivalent to root on the host.

It runs the Chatto operator CLI through docker exec, and starts short-lived helper containers for backup and restore. That requires /var/run/docker.sock, and anything that can reach that socket can start a privileged container and take over the machine.

The consequences, stated plainly:

• A panel superadmin can, in principle, do anything on the host — not just to Chatto. Panel-admin permissions are useful for splitting up moderation duties, not a security boundary against a determined admin.
• Anyone who finds a way to execute code in this container has the host.
• Treat panel superadmin as equivalent to handing out SSH.

So:

• Never expose it directly to the internet. Bind to loopback and put a reverse proxy with TLS in front (Nginx Proxy Manager, Caddy, Traefik). Better still, don't publish it at all and reach it over an SSH tunnel: ssh -L 8080:127.0.0.1:5000 you@your-host
• Use long, unique passwords for panel accounts.
• Give people the lowest tier that does their job.

If that isn't acceptable for your setup, don't run this.

• Passwords hashed with werkzeug.security (PBKDF2), never stored in the clear
• Sessions are HttpOnly, SameSite=Lax, Secure by default, and expire
• CSRF token required on every state-changing request
• Failed logins throttled per IP, with an exponential lockout
• The Flask secret key is generated 0600 if not supplied
• Uploads capped, so a restore cannot exhaust memory or disk
• The owner Chatto account is protected from every tier, server-side

Panel-admin accounts store explicit permissions. The old creator, moderator, administrator, and superadmin levels are presets for creating or resetting an account's permission set; non-superadmin accounts can diverge from their preset after creation.

Permissions are grouped by module: Overview, Chatto Users, Roles, Admins, Logs, Backups, Maintenance, Server Settings, Updates, and System. Relevant modules also have action-level permissions such as create, edit, delete, run maintenance, manage settings, run updates, and manage panel admins.

Superadmin remains permanently unrestricted. The panel prevents deleting or demoting the last superadmin, and prevents removing permissions from the last remaining superadmin account.

Legacy preset summary:

"Scoped" means the log shows creator, moderator and administrator activity, but not superadmin activity.

Milestone 6 separates these into global Admin Panel permissions and per-server grants; see ARCHITECTURE.md for the current authorization model.