Unix domain sockets

The permissions on the domain sockets are their only protection from bad guys. Be sure that the mix of the identity of the running phhttpd server, the directory the domain sockets (control, tunnel) are in, and their modes are all properly setup so that unsavory folks cannot open these files. A hostile person getting access to these sockets would spell bad things for the running phhttpd.