Security responsibilities of resellers
This page is for owners and technical leads at resellers. When you sell a site, a plan or a product, the customer trusts you with its security, whatever part the project, a host or 7x plays behind you. The partners' version is Security responsibilities of partners.
Contents
- Shared responsibility
- Per-site checklist
- Credentials
- Vulnerabilities and updates
- Incidents
- Demo and training sites
Shared responsibility
| Who | Responsible for |
|---|---|
| The project | Secure code in the kernel and its extensions; fixes published in releases (SECURITY.md) |
| The host (you, or your supplier) | Servers, PHP, database, TLS, network, backups |
| You as the reseller | Configuration, extensions chosen, custom code, updates applied, monitoring, incident response, as your contract says |
| The customer | Accounts and passwords of their editors, the content, who they give access to |
Write this split into each contract (Contracts with customers). If you buy in hosting or white-label services, you remain responsible to the customer.
Per-site checklist
- To do: Hardened as in Security hardening and chapter 13 of the installation book (Security hardening chapter).
- To do: Default and shared passwords changed (Default administrator password).
- To do: Setup wizard and installer files not reachable.
- To do: TLS everywhere (TLS and HTTPS); the administration's Content Security Policy not weakened (Content Security Policy).
- To do: Debug output off in production.
- To do: Two-step sign-in offered to administrators (Two-step sign-in).
- To do: The administration restricted where possible (Restricting the administration).
- To do: Audit trail on and reviewed (Audit trail).
- To do: Custom code reviewed for SQL injection, XSS and CSRF.
- To do: Updates applied on a schedule (Keeping customers current).
- To do: Backups tested by a restore.
- To do: Each customer isolated from the others (Multi-tenant isolation).
Credentials
- Never in tickets, chats, e-mails or Git repositories.
- Hand credentials to customers through a secure channel; make them change passwords on first sign-in.
- Personal accounts for your staff, never a shared administrator account.
- Remove accounts of staff who leave, on your side and in every customer's administration.
Vulnerabilities and updates
- A vulnerability in Exponential goes privately to [email protected]; "You can expect a first answer within one
business day" (
SECURITY.md). Never report it in public (Escalation for resellers). - Fixes are made on
mainand published with the next 6.0.x release; "a published tag is never changed". Your customers are protected only when you apply the release. - Promise a time to apply security releases only after measuring how long a tested update across all your sites takes (Service level design).
Incidents
Have a short plan for every customer:
- Contain: take the affected part offline or block the attack path (maintenance mode helps: Maintenance mode).
- Preserve: keep logs and copies for analysis (Security log).
- Inform: the customer at once; authorities if the law requires it (Data protection for resellers).
- Fix: apply the fix, rotate credentials, restore clean backups.
- Learn: write down what happened and change the process.
The step-by-step runbook is Compromised site.
Demo and training sites
A public demo runs in demo mode (EXP_DEMO_MODE=1), which only protects administrator passwords: a visitor signed in
as an administrator can still change settings and upload files. Keep demos on their own system user, pool and
database, never with real data, and make sure the variable never reaches a production process
(Demo sites for resellers).
Related pages
- Security responsibilities of partners
- Hardening for hosts
- Security review checklist
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.