SpiderPanel combines an Xray panel with a Worker relay
SpiderPanel manages users, inbounds, groups, subscription pages, quotas, expiry, and generated proxy configurations. Normal users connect to Reality or WebSocket inbounds associated with the panel. Users assigned to the optional Worker route connect through a Cloudflare Worker, which checks their UUID and quota in KV before forwarding traffic through a chosen proxy address. Railway hosts management and configuration delivery rather than carrying Worker-routed user traffic.
The repository is small by platform standards: our checkout had 31 files, about 12,012 source lines, and occupied 5.3 MB at commit a391c07. Much of the application lives in a 346 KB main.py, with another 118 KB in pages.py. That compact shape makes a manual audit possible, but it also concentrates authentication, user management, configuration generation, Worker control, and state changes into a few large files.
The README is bilingual and unusually specific
A Persian introduction describes the panel, followed by extensive English documentation. The README covers Railway deployment, environment variables, Cloudflare permissions, traffic flow, supported configuration types, the browser scanner, API routes, project layout, and security notes. English-speaking operators are not left with a translated summary. They can follow the full setup and inspect how the panel says traffic and credentials move.
The documented interface handles up to 10 custom scanned configurations per user and lets a user select up to 3 proxy addresses. Auto-sync defaults to every 3,600 seconds and reads a third-party list described as covering 62 countries. Those numbers make the behavior concrete, but they also expose an external trust path: the panel parses changing data from GitHub and redeploys its Worker map. Pinning or reviewing that source is safer than treating it as configuration owned by the application.
What happened when we ran it
Our Python install succeeded in 19 seconds in a fresh Debian container with 3 CPUs and 8 GB of RAM. It installed 66 packages and used 101 MB on disk. The detected build completed in 4 seconds. For a 5.3 MB checkout, the installed environment is substantial but still manageable on ordinary development and CI machines.
No test script or target existed, so our harness skipped tests. The repository also had no tests directory and no GitHub Actions workflow files. pip-audit reported 34 known vulnerabilities. That is the strongest reason to pause: the application handles administrator sessions, user UUIDs, subscription links, private keys, Cloudflare credentials, quotas, and network routing, yet the published tree gives no automated regression path and carries a large advisory count.
A passing 4-second build does not offset those findings. Before any real users are added, an operator should patch or replace affected dependencies, rerun the audit, add authentication and authorization tests, and verify expiry and quota decisions at both the panel and Worker. Our run did not exercise a live Railway project, Cloudflare account, Xray process, or proxy route because the sandbox had no secrets. No claim about end-to-end traffic follows from the build result.
The defaults are unsafe outside a private trial
The Railway guide tells users to sign in with admin and change the password immediately. It also lists spider-panel-secret-key-v2 as the default session and hashing secret, with a warning to set a strong random value. These are documented defaults rather than hidden backdoors, but internet scans do not care about intent. Deploying first and fixing them later creates a window where the management panel may be predictable.
Private material extends beyond the 2 initial defaults. Reality private keys and application state are stored under the data directory. The Cloudflare token stays server-side and is removed from API responses, according to the README, but it still grants deployment and KV-editing powers. Public subscription routes return generated configurations for their identifiers. Operators need strong identifiers, restrictive file permissions, encrypted backups, token rotation, TLS, and access logs before inviting customers.
Cloudflare integration adds a second control surface
The Worker setup can verify an API credential, discover the account's Worker subdomain, create a KV namespace, deploy relay code, and copy active user records into KV. This is convenient because the panel owns the workflow from one screen. It is also privileged automation. A mistake in token scope, injected Worker template values, user synchronization, or deletion behavior can affect a separate Cloudflare account, not just the Python process.
Authentication supports either a scoped bearer token or a global API key with email. The recommended scoped token still needs Workers Scripts and KV Storage edit permissions. Worker-routed users depend on matching state in 2 places: the panel's JSON data and Cloudflare KV. Test what happens when sync fails, the token expires, KV is unavailable, quota changes race with a connection, or the Worker deploy succeeds only partially. The README explains the happy path but offers no automated suite for these failure cases.
Project health is too thin for a trust-heavy service
The repository was pushed on 2026-08-24, one day before this review, so the code is current. GitHub showed 0 open issues and pull requests, an issue-only search also returned 0, and there was no published GitHub release. For a project with 722 stars and sensitive responsibilities, an empty queue does not supply the maintenance evidence that active triage, tagged releases, and changelogs would provide.
Licensing needs cleanup too. The README ends with an MIT statement, while GitHub detects no license and the 31-file root listing contains no LICENSE file. A personal experiment may accept that ambiguity; a business should ask for a standard license file before relying on the permission grant. Combined with 34 audit findings and no tests, SpiderPanel is best treated as inspectable source for a controlled trial, not a ready-made subscription business backend.