Security audit 2026-10-17, finding I1 (stage 2): the guide told operators to give the TLS private key to group 10998 so the panel can back it up, and postfix is in that group too - every network-facing Postfix daemon could read the key. The key gets a group of its own, 10997, whose one member is the panel. Help's Backup topic names it and says why. check.py: 0 violations; outlines unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>