Any website can be targeted for an attack.
Your domain and certificate aren't really something that can be "attacked" in the way that a site can, but you should keep your domain registration credentials secure and renew your domains on time to ensure that you can't lose them.
We do not control the code that you upload for your applications, so your apps are only as secure as you make them.
When you create a shell user, database, app, or mailbox via the Opalstack dashboard those items are created with secure default passwords and permissions. It is your responsibility to keep them secure after that point.
If you run multiple apps as a single shell user and that shell user is subsequently compromised (either through one of the apps or through weak passwords/permissions) then all apps for that shell user are at risk.
You can defend your own shell users and apps by maintaining strong passwords and secure filesystem permissions and by avoiding security problems in your applications, ie make sure the code that you write is secure and that you keep your applications updated with the latest security updates. You should also monitor your own logs to spot possible attacks and other signs of trouble.
Opalstack manages the security of the server itself via network firewalls, 24/7 monitoring, and regular system updates.
