Accounts, access, disclosure.

Accounts

Sign-in is delegated to SucksHosting ID, an external identity provider using OAuth 2.0 with PKCE. This site never sees or stores your password. When you return from the provider, we receive a short-lived code and exchange it for a session.

• Use a unique password and a password manager for the identity provider.
• Enable two-factor authentication there if it is offered — it protects the panel too.
• Logging out ends the session on this device; it does not delete your server.

Server access

The panel is the only supported way in. Each server runs under its own system user, so a compromised server can't read another one's files.

• Panel passwords are generated once and must be changed on first login.
• SFTP uses the panel account, not your email address.
• We never ask for your password by email — anyone who does is not us.

Data

We keep your email, the servers attached to your account, and the files you upload. Backups live on the same node as your server; download anything critical. Details are in the privacy policy.

Report a vulnerability

Email security@suckshosting.example with enough detail to reproduce the issue. Please don't test against other people's servers, and give us a reasonable window before publishing.

• We acknowledge reports as fast as one person can.
• There is no paid bounty right now; we'll credit you if you want that.
• Reports about the game itself belong upstream, not here.

Incidents

If something affects your server or your account, we email you, describe what happened in plain language, and say what we changed. No "we take security seriously" letter without specifics.