BackupXo holds credentials to your databases, so security is the core of the design. This page summarises the measures in place; the source code is open for review.
Credentials
- Database passwords, storage keys and Telegram tokens are encrypted with authenticated symmetric encryption (Fernet, AES-128-CBC + HMAC-SHA256) before being written to the database. The encryption key lives only in the server environment, never in the database or the repository.
- Passwords are never passed on a command line. Dump and restore processes read them from a temporary option file with
0600permissions that is deleted immediately afterwards. - Account passwords are hashed with argon2id.
Sessions and access
- Signed, HttpOnly, SameSite cookies; sessions expire automatically.
- Optional TOTP two-factor authentication with one-time recovery codes.
- Rate limiting on sign-in, two-factor and registration; Cloudflare Turnstile bot protection.
- CSRF tokens on every state-changing request; a strict Content-Security-Policy,
X-Frame-Options: DENYand other hardening headers. - Every user sees only their own servers, storage, jobs, runs, backups and restores. All writes are recorded in an audit log with timestamp and IP.
Backups in transit and at rest
- Dumps are streamed
mariadb-dump → zstd → your bucketas multipart uploads. Nothing is written to local disk and the service never keeps a copy. - Uploads are verified: object size is compared to the bytes streamed and a SHA-256 checksum is stored for every backup.
- Connections to your database servers can use TLS; uploads to your bucket always use HTTPS.
- Buckets are yours: server-side encryption, object lock and access policies are under your control.
Operational
- Statement timeouts and identifier validation in the data browser; identifiers are quoted and values parameterised.
- Dependencies are pinned; the service runs as an unprivileged user in a minimal container.
Reporting a vulnerability
If you believe you have found a security issue, please report it to [email protected] before disclosing it publicly. We will acknowledge reports promptly and keep you informed while we fix the problem.