HAProxy (Hardened) — security notes

• No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.
• Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• Rebuild cadence: every image is rebuilt at least monthly against current OS security advisories, and event-driven when a critical CVE with an available fix lands. Vulnerability scanning gates every build.
• Report a vulnerability: disclosure policy.

Network exposure

Port	Purpose	State
22	SSH (key-only)	default-open
80/443	Frontends you configure in haproxy.cfg	default-open (firewall) — no listener until you configure one
8404	Stats endpoint — bound to 127.0.0.1	optional (reach via SSH/IAP tunnel)

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Shared responsibility

We maintain	The hardened image: package selection, hardening baseline, CVE rebuilds, listing freshness, and these docs.
You control	The running instance: OS patching between image versions, network exposure, IAM, data, and backups.
Your cloud provides	Physical/hypervisor security, marketplace billing, and the firewall primitives this design relies on.