Security overview

Security in Expanse Panel is a partnership: we build a modern sign-in, roles, and billing flow; you use strong habits on your side (password or identity provider, two-step verification, and not sharing the owner account). No checklist stops every risk, but the items below are the ones that help real teams the most.

The three layers to think about

Your user account — who can sign in as you. Protect this with a strong identity, 2FA, and devices you control.
See Two-factor authentication (2FA) and Your account and sign in.
Your team — who is invited, and which role they have. A mistake here is the same as giving someone a key to the whole office.
See Inviting members and Team roles.
Your services — games and VPS you run. Even with a perfect Expanse login, a weak game admin password or an open port to the world can be abused. Good security habits has a short list for that layer.

What we will and will not do

We will	We will not
Send you to the real panel and billing screens for money	Ask for your full card or CVV in a ticket or chat
Use normal 2FA and lockout patterns you expect from a serious host	Ask you to “install” a random remote tool from an unofficial email
Investigate fraud and abuse with care	Ignore phishing reports that mention our brand without checking

If someone claims to be “Expanse” but pushes you to a new payment site or a download you did not start from expanse.host or the real panel, stop and open a support ticket from the official app.

Reporting a security issue

For urgent issues (a bug that could leak data or bypass login), use the responsible path our website lists for security contact if we publish one, or open a private ticket and mark it clearly as security so it is not treated as a normal how-to.
For abuse (spam, illegal content, harassment), we take reports seriously and will act under our policies and the law.

Protecting your account — a compact checklist
Invoices and phishing for recognizing real billing email