Recent changes
Wednesday November 04 2026
-
NIS2 and an Exponential site Updated Markdown page
For EU public bodies that fall under the NIS2 Directive (EU) 2022/2555 or national cybersecurity rules derived from it - a general framing of how features of Exponential support common risk-management measures (logging…
-
NIST Cybersecurity Framework and an Exponential site Updated Markdown page
For public bodies that organize security with the NIST Cybersecurity Framework 2.0 - a general framing of where Exponential's features and the operator's practices fit under the six functions Govern, Identify, Protect…
-
Mapping OWASP ASVS to Exponential Updated Markdown page
For public bodies whose security requirements reference the OWASP Application Security Verification Standard - the ASVS 4.0.3 chapters the project maps controls to, the status Unverified, the one known level 1 gap…
-
Mapping the OWASP Top 10 to Exponential Updated Markdown page
A category-by-category view of the OWASP Top 10 (2021) for public bodies - the mitigations Exponential ships, the operator's part, and the evidence to show an auditor, based on the project's security statement.
-
Password policy Updated Markdown page
For public bodies that must set a password policy - Exponential's password settings (minimum length, weak password check, composition rules, reset link lifetime, change notification), the shipped defaults, and a…
-
Patching cadence Updated Markdown page
For public bodies that must keep systems patched - how Exponential releases and supports versions, what to watch (kernel, extensions, Composer dependencies, PHP, database, engine), a practical update routine with test…
-
Penetration tests of an Exponential site Updated Markdown page
For public bodies commissioning a security test of their site - scope, rules of engagement, what to give testers (versions, siteaccesses, test accounts per role, known gaps), how to prepare the installation, and how to…
-
Proxies and trusted headers Updated Markdown page
For public sites behind load balancers, CDNs or TLS terminators - why forwarded headers must only be trusted from your own proxies, Exponential's TrustedProxies setting and reading from the right, Velocity's own list…
-
Request logs and the security log Updated Markdown page
For administrators of public sites - what Exponential writes to 404.log and security.log (probes, traversal, injection, scanners, 404 bursts), how addresses and query values are masked, how long the logs are kept, and…
-
request-shield in front of a public site Updated Markdown page
For public bodies whose sites face constant scanning - what request-shield is (a separate MIT-licensed PHP firewall by the CJW Network, not part of Exponential's composer.json), how it complements the kernel's request…
-
Roles and least privilege Updated Markdown page
For public bodies that must apply least privilege to website staff - how Exponential's roles, policies and limitations work, which policies are security-sensitive, a sample role design for a public body, leavers, and…
-
Secrets in settings/override Updated Markdown page
For administrators and hosting teams of public sites - which files in settings/override hold secrets (database password, audit keys, mail preference secret, Velocity token, 2FA encryption key), what happens if they are…
-
Security headers Updated Markdown page
For administrators of public sites - the five security headers Exponential sends on every page by default, how to check them, how to change one safely, and how Velocity, Apache and nginx handle static files.
-
Exponential's security posture at a glance Updated Markdown page
For public bodies assessing Exponential - the project's own status against the OWASP Top 10, OWASP ASVS, Content Security Policy, the OWASP cheat sheets and coordinated disclosure, what is on by default, what is off by…
-
Separating the administration Updated Markdown page
For public bodies that want the editing interface out of the public's reach - giving the administration siteaccess its own host, restricting it by network, VPN or a second authentication, request rules for system URLs…
-
Two-step sign-in for public staff Updated Markdown page
For public bodies that require multi-factor authentication - how Exponential's two-step sign-in works (authenticator app or e-mail code, extension sevenx_authentication_2fa), how to turn it on and require it, how to…
-
Vulnerability disclosure Updated Markdown page
For public bodies - how the Exponential project receives and fixes vulnerability reports (SECURITY.md, private e-mail or GitHub advisory, supported versions, immutable releases), and how to set up your own disclosure…
-
Digital sovereignty Updated Markdown page
The sovereignty section of the government help: self-hosting, government cloud, external services, the GPL and the GFDL, procurement, lock-in, formats and exports, databases, the source of the code, who stands behind…
-
Avoiding vendor lock-in Updated Markdown page
The kinds of lock-in a public body can run into with a web platform (license, code, data, hosting, skills, contracts) and what Exponential and good practice offer against each, with a short self-assessment.
-
Choosing a support provider Updated Markdown page
How a public body chooses who supports its Exponential installation: community support, partners of the published partner program, 7x, or in-house staff, what each provides according to the partner documentation, and…