Identity & least privilege

FortiPanel is designed around scoped access, tenant context and least-privilege integrations. Where Microsoft 365 data is used, permissions and consent remain explicit.

Encryption & secret handling

Transport security is expected for service communication and secrets belong server-side. Sensitive credentials are not intended to be exposed to browser code or public logs.

Tenant separation

Customer views and evidence are tenant-scoped. Security-sensitive actions should validate organization and tenant context before returning or changing data.

Auditability & evidence

FortiPanel records security evidence, incident activity and compliance status where the underlying source can actually prove it. Missing evidence is not presented as compliant.

Vulnerability management

Vulnerability, exposure and endpoint signals can be correlated in FortiPanel. Public security researchers can report suspected vulnerabilities through our coordinated disclosure process.

Responsible Disclosure

Found a potential vulnerability? Please avoid unnecessary access to personal or production data and send us reproducible technical details through the disclosure channel.

Open Responsible Disclosure →