MSP Zero / Security
Security, project by project
What each of the six tools protects, how, whether it is on out of the box, and what you have to set up yourself — read from each project’s source code at a named release, with a link to the code or test behind every claim.
The strongest protection in each tool
One row per project. Each project page’s Security section has the next one or two as well, with the same detail.
| Project | Strongest verified protection | Default | You set up | Evidence |
|---|---|---|---|---|
| clientst0r Documentation & service desk | One set of checks guards every staff password reveal Client credentials from being read by anyone whose role, approval or location does not allow it. | Partly on by default | Choose which roles get View passwords, flag the entries that need approval, and add access rules for the clients that want them. | Source at v3.17.656 All 3 protections Report a vulnerability |
| OPNMGR OPNsense fleet management | New agent versions wait for you to promote them The whole fleet from a bad or tampered agent build rolling out everywhere at once. | On by default | Mark your pilot firewalls, then promote each version once it has run cleanly on them. | Source at v3.80.3 All 3 protections Report a vulnerability |
| Depl0y Infrastructure management | Proxmox and server-management credentials encrypted at rest Stored Proxmox and BMC credentials, if the database file or a copy of it leaks, and from being read through the browser. | On by default | Back up /etc/depl0y/config.env with the database, and give Depl0y its own Proxmox API token. | Source at v2.2.114 All 3 protections Report a vulnerability |
| St0r Backup administration | Each account sees only its own customers' backups One customer's backed-up files from accounts assigned to other customers. | On by default | Assign each non-admin account to its customers. The audit entries are in the urbackup-gui journal, tagged [audit]. | Source at v3.2.131 All 3 protections Report a vulnerability |
| rem0te Remote support | Each business's computers are walled off on the server Customer computers, and the credentials that reach them, from people at other businesses and from colleagues without a grant. | On by default | Create a business for each customer and grant users per computer. Platform Admins reach every business by design, so keep that role to a few people. | Source at v0.29.0 All 3 protections Report a vulnerability |
| m0nitor Network monitoring & security | Every finding carries its evidence and the exact query Your team from acting on an alert nobody can explain, or escalating a false positive. | On by default | Open the Coverage page to see which flows and syslog sources are arriving for each firewall. | Source at v1.58 All 3 protections Report a vulnerability |
How these were checked
- Each project was read at its latest published GitHub release — the tag is named in every evidence link, so the line you land on is the line we read.
- A protection is listed only when the code at that release implements it. Something the documentation describes but the code does not, or that is on a roadmap, is left out.
- “On by default” means a fresh install following the project’s own guide has it without further configuration. Where it needs you, the row says what to do.
- These are reviews of design and code, not penetration tests or audits. Report suspected vulnerabilities privately through the link in each row, not in public issues.