Security & Account Policy

At VisiHost, security is a foundational commitment. We implement enterprise-grade hardware firewalls, automated hypervisor isolation, and kernel-level network filtering to protect our hosting nodes.

However, security in cloud and container hosting is a shared responsibility. While VisiHost secures the underlying physical and virtualization infrastructure, you are responsible for securing your account credentials, applications, API secrets, and operating environments.

---

1. Protecting Account Credentials#

Your billing area and control panel logins grant complete administrative control over your active services and stored data:

Multi-Factor Authentication (2FA / MFA)#

• We strongly advise enabling Two-Factor Authentication (2FA) on both your Billing Account and your Pterodactyl control panel (paid.visihost.in).
• Use time-based one-time password (TOTP) authenticator apps such as Google Authenticator, Authy, or Bitwarden.
• Store your one-time backup recovery codes in a secure, encrypted offline vault.

Password Hygiene#

• Never Reuse Passwords: Never use the same password across multiple online gaming platforms, Discord bots, and your VisiHost account.
• Complexity: Utilize high-entropy passwords of at least 16 characters containing a mixture of uppercase letters, lowercase letters, numbers, and symbols.
• Password Managers: Employ reputable password managers (such as 1Password, Bitwarden, or KeePass) to generate and store credentials.

---

2. Access Delegation & Subuser Permissions#

Never share your master control panel login, email credentials, or SSH private keys with friends, moderators, or developers:

1. Granular Subusers: The Pterodactyl control panel features a native Users / Subusers management module.
2. Principle of Least Privilege: When delegating access to team members, grant only the specific permissions they actually need (such as console view, file management, or restart permissions).
3. Revocability: When a developer leaves your project, their subuser access can be revoked instantly with one click without changing your master credentials.

---

3. Securing API Keys, Tokens & Environment Secrets#

Treat Discord bot tokens, Telegram bot tokens, database passwords, and third-party API keys with the same level of care as private bank passwords:

• Never Commit Secrets to Git: Do not commit raw tokens or .env files into public GitHub, GitLab, or Gitea repositories. Automated internet bots scrape public repositories within seconds to hijack Discord bots and cloud credentials.
• Use the Startup Tab: In the VisiHost control panel, store sensitive tokens directly in the Startup tab under Environment Variables, or use an uncommitted .env file created directly via the panel File Manager.
• Instant Token Revocation: If you accidentally expose a bot token or database credential, regenerate it immediately from the Discord Developer Portal or database manager.

---

4. Securing Cloud VPS Instances#

If you operate a self-managed Cloud Virtual Private Server (VPS) with full root access:

1. SSH Key Authentication: Disable password-based SSH authentication (PasswordAuthentication no in /etc/ssh/sshd_config) and rely exclusively on 2048+ bit RSA or Ed25519 SSH keys.
2. Disable Direct Root Login: Create a dedicated sudo user and disable direct root SSH logins (PermitRootLogin no).
3. Configure Firewall (UFW / iptables): Enable an active firewall to block all ports except those actively in use:
   bash

   Copy

   sudo ufw default deny incoming
   sudo ufw default allow outgoing
   sudo ufw allow 22/tcp
   sudo ufw enable

4. Regular Security Updates: Keep your Linux distribution updated with latest security patches:
   bash

   Copy

   sudo apt update && sudo apt upgrade -y

5. Intrusion Prevention: Install tools like fail2ban to automatically ban IP addresses attempting brute-force SSH attacks.

---

5. Compromised Instances & Incident Response#

If a customer server is compromised due to weak credentials or unpatched application code and begins transmitting malicious traffic:

1. Automated Isolation: VisiHost's network edge monitors will automatically quarantine the affected container or IP address to prevent outbound attacks and protect IP reputation.
2. Emergency Notification: An emergency ticket is opened detailing the security breach.
3. Remediation Steps:
   • The customer must inspect files, identify the injected backdoor or web shell, and remove the malicious code.
   • All account passwords, database credentials, and bot tokens must be refreshed immediately.
   • If the system cannot be safely sanitized, our team will assist in reinstalling the container from scratch.

---

6. Account Recovery & Identity Verification#

If you lose access to your primary email address or authenticator device:

• To protect your account from social engineering and unauthorized takeover, our team follows strict identity verification procedures.
• You will be required to provide verifiable proof of ownership, such as recent invoice transaction IDs, payment gateway receipts (UPI reference or PayPal transaction ID), and original registration details.
• Access cannot and will not be restored unless ownership is definitively established.

---

7. Frequently Asked Questions (FAQ)#

What should I do if I accidentally committed my Discord bot token to GitHub?#

Treat the token as compromised immediately:

1. Open the Discord Developer Portal.
2. Go to your bot's Bot tab and click Reset Token.
3. In your VisiHost control panel, update the BOT_TOKEN in the Startup tab.
4. Restart your container.

How can I let my developer manage my bot without giving them my password?#

In your container dashboard, open the Users (or Subusers) tab and click Create New. Enter your developer's registered email and select only the specific permissions they need (such as Console, File Management, or Restart). They can then log in using their own separate credentials.

Does VisiHost support hardware security keys (YubiKey)?#

Yes. You can link standard TOTP authenticator apps or FIDO2/WebAuthn hardware security keys to your billing account and control panel for enhanced account protection.

---

8. Contact Security Support#

To report a security vulnerability or report compromised services:

• Security & Support Desk: support@visihost.in
• Secondary Contact: visihostindia@gmail.com
• Client Area Ticket: https://billing.visihost.in