Cotton turns self-hosted security posture into an operator screen. The checkup names concrete risks such as key source, public mode, admin 2FA, diagnostics, dumpability, seccomp, ptrace, Docker socket exposure, writable rootfs, confinement, and database integrity rollout state.
The checkup is intentionally admin-only. It is not a public healthcheck endpoint and not a marketing badge; it is a private operator surface for seeing which deployment and account choices still need attention.
Cotton can inspect process and container posture such as .NET diagnostics, Linux dumpability, effective UID, no-new-privileges, seccomp mode, ptrace capability, writable root filesystem, Docker socket exposure, host PID namespace hints, core dump settings, and AppArmor or SELinux confinement.
The page can warn about master-key source, public or demo mode, and admin accounts without 2FA. That matters because storage encryption and passkeys are only useful when operators can see how the instance is actually configured.
Database integrity signatures are part of the posture story. The checkup can warn while bridge mode remains enabled so operators know when protected metadata is still in a rollout state.
The practical target is not paranoia from the first boot. Cotton makes cheap hardening layers visible: non-root runtime path, disabled .NET diagnostics, dumpability reduction, no-new-privileges, seccomp, 2FA coverage, and avoiding obvious Docker socket exposure.
Read-only root filesystems, custom seccomp or AppArmor profiles, encrypted swap, kernel ptrace settings, TPM/HSM/KMS, or a separate key agent can be valuable, but they are expert choices. Applied blindly, they can break volume permissions, debugging, previews, or restore workflows.
The checkup can report public account creation, master-key source, admin 2FA coverage, database-integrity bridge state, .NET diagnostics, Linux dumpability, seccomp, CAP_SYS_PTRACE, writable rootfs, Docker socket exposure, likely host PID namespace use, core dump limits, core_pattern, and AppArmor or SELinux confinement.
Self-hosted security cannot be treated as assumed. Cotton is stronger when the admin UI says what is risky, why it matters, and which ordinary hardening steps are still missing.
Cotton does not pretend software can defeat full host compromise. If an attacker can execute code inside the Cotton process, software flags cannot fully hide the in-memory key from that process. These checks mostly reduce accidental exposure, dump surfaces, and neighbor-process/container privilege risks.
Cotton does not sell the admin score as a magic shield. It is a practical surface for finding obvious exposure before the instance is treated as public infrastructure.
.NET diagnostics, Linux dumpability, effective UID, no-new-privileges, seccomp, ptrace, writable rootfs, Docker socket, host PID hints, core dumps, and confinement.
Master-key source, public/demo mode, and admin accounts without 2FA are surfaced as operator decisions instead of hidden deployment trivia.
Database-integrity bridge state tells operators whether protected SQL metadata is still in rollout posture.
If hostile code runs inside the Cotton process, software cannot fully hide the in-memory key from that process. The checkup is still valuable because many real self-hosting failures are accidental: diagnostics left open, dump surfaces enabled, Docker socket mounted, weak admin posture, or public mode forgotten.
No. It is an admin-only operator page because it exposes deployment posture and hardening gaps. Public healthchecks should not reveal those details.
No. The score is a practical posture summary, not a security guarantee or audit result. Host compromise, bad backups, exposed secrets, and weak operational practice still matter.
Environment key mode can be useful for unattended home-server restarts, but deployment systems can retain env metadata. Browser unlock keeps the key out of that metadata at the cost of manual unlock after restart.
Yes. Read-only filesystems, custom profiles, or aggressive container restrictions can break volume permissions, debugging, previews, or restore paths if applied without testing.