Hi, I was running your panel.sh installer and I found several items that look problematic or unexpected. Please clarify and fix the points below:

1. Hardcoded domain

Script uses /etc/letsencrypt/live/chandpurtelecom.xyz and other chandpurtelecom.xyz references (see copy_conf_for_ols).
Why is a third-party domain hardcoded in an installer? This causes my server to create/point SSL and config for a domain I do not own.

2. Remote downloads & execution

The script downloads and executes multiple remote scripts at runtime, e.g.:
- https://olspanel.com/panel_setup.zip
- https://olspanel.com/extra/*.sh (several curl | bash calls)
- https://raw.githubusercontent.com/osmanfc/olspanel/... (requirements, files)
Why are you fetching and executing code from these external URLs without verification? This is a high risk for supply-chain injection.

3. Plaintext credentials on disk

Files created/used under /root/ store secrets in cleartext:
- /root/item/mysqlPassword
- /root/db_credentials_panel.txt
- /root/webadmin
Please explain how these are protected and why secrets are written in plain files. Also provide a plan to encrypt/remove these after use.

4. Automatic cronjobs & restart triggers

Script installs multiple cron jobs (backup, limit_check, fail2ban task, and a watcher that restarts OpenLiteSpeed on certain .htaccess conditions).
Explain what each cron job does and why automatic service restarts are triggered by file changes (this could be abused to cause instability).

5. Random port and service changes

Script replaces port 2083 with a random port saved to /root/item/port.txt. Why is this randomized and how should I find/control the port?
It also installs a systemd cp.service and replaces Python paths to /root/venv/bin/python. Please provide the service file sources and explain behavior.

6. Files and paths modified

The installer copies many config files to system locations and changes permissions:
- /usr/local/lsws/Example/html/*
- /etc/powerdns/..., /etc/postfix/..., /etc/opendkim/*
Confirm which files are provided inside the package and which are fetched remotely.

7. Commands executed as root

A lot of sudo/root operations happen automatically (package installs, systemctl, iptables/ufw modifications). I need an explicit list of required changes before running the script.

8. Supply / source verification

Please provide:
- Link to the canonical source repository for this project (not a raw file).
- Release tag or commit hash used to generate this panel.sh.
- SHA256 checksum or signed release of any downloaded artifacts (panel_setup.zip, extra scripts).
- License and contact for security issues.

9. Security audit / assurance

Has this installer been security audited? If not, will you allow a short third-party review or provide a safe mode that does not download/execute remote scripts or touch LetsEncrypt for domains I don’t own?

Immediate requests (please reply):

Confirm you will remove or parameterize the hardcoded domain (or provide a version that prompts for domain).
Stop curl | bash without checksum/signature — provide checksums or repository to verify.
Provide a quick checklist of what the script will modify (packages, files, services, ports).
- Provide a safe, non-destructive installer or a dry-run mode.

Thanks, I need these answers before I continue using this installer on any server with real data.