Most breaches come from basics left unconfigured. Haloo handles them by default, no expertise required.

A site's security shouldn't be a separate project. In Haloo, the important measures are on from the start, with no configuration.

What is on by default

  • CSRF on every panel action, with a token validated on each write.
  • bcrypt passwords at cost 12.
  • Passkeys (WebAuthn) — sign in without a password, with your fingerprint or Face ID.
  • Secrets encrypted at rest with libsodium: your AI key isn't stored in clear text.
  • HTML sanitization on user content, with a strict tag allowlist.
  • SSRF protection on design import and anti zip-slip on backup restore.

A small attack surface

With no third-party plugins in the critical path, the attack surface is far smaller than a CMS with dozens of extensions. Less foreign code = fewer surprises.

A dedicated security audit went through the code and led to 12 fixes applied — documented, not just promised.

What stays on you

Technology gets you far, but you still mind a few things: delete install.php after setup, keep a copy of secret-key.bin separate from backups, and use HTTPS. Haloo reminds you of each in the panel.

The bottom line

Security shouldn't be hard — it should be the default. Haloo puts the important barriers up from the start, so you can focus on content, not breaches.