Security
Security model
Dual-signed jobs, passkey approvals and a privilege-separated agent.
Zefily is designed so that a stolen panel session, or even a compromised panel, cannot quietly change your servers.
Every job is signed twice
The panel signs each job, and a separate signing service on its own machine signs it again after checking its policy. The agent verifies both signatures, a monotonic sequence number and an expiry before running anything. A replayed or tampered job is refused.
Passkey approvals
High-risk actions — a root terminal, reboots, deleting site files or databases — wait for your passkey on your device. The signing service checks the passkey itself and emails you when an approval is used.
A privilege-separated agent
The part of the agent that talks to the network runs as an unprivileged user. Only jobs that passed verification reach the small root helper that applies them.
No open ports for the panel
The agent connects out to Zefily. Your firewall stays closed except for SSH and your sites.
Hardening by default
SSH password login is turned off once key access is proven, automatic security updates run with a reboot window you choose, and the firewall only opens what you need.
Updated October 15, 2026