

Have you had anyone with experience with security look at this thing? There’s a lot of really questionable practices in your schedule shell scripts. I especially find how you’re handling VPN secrets kinda worrying. And the backup_challenge_clients.sh script isn’t robust at all. Your nginx config has a few bad choices like lack of try_files, the regex \.php$. It’s definitely not hardened so I hope people don’t put this Internet facing.
I’ve spent like 5min in the GitHub to get a feel for the project maturity. Personally, I don’t think this is suitable for actual use yet.
If you’ve not done any security assessments on your project yet, you might not want to (a) call it “Safe”box and (b) might not want to start charging money for it until you do.
I worry you’re setting yourself up for a hard-to-shake-off embarrassment should a nasty vuln be found. Maybe a name like “selfbox” etc that drops the connotation of security would be safer.
Edit: Kudos on the project website though! Looks fricking gorgeous.









Or spin up TES3MP with some friends and experience it together!