Security

Security

Smart Drink Fridge is designed for a trusted home network.

Recommended boundary

• Keep port 5000 private
• Do not create a public router port-forward
• Use Tailscale and HTTPS or another VPN for remote access
• Use a long random SECRET_KEY
• Use a private cancellation password
• Keep .env, Home Assistant tokens, Pushover credentials, and Tailscale keys secret
• Install security updates on the Docker host

Docker socket

The optional one-click updater requires /var/run/docker.sock. Access to this socket is effectively root control over the Docker host.

Only enable docker-compose.updates.yml when:

• The application is reachable exclusively by trusted users
• The host and container images are kept updated
• You accept the Docker daemon access risk

Use standard manual updates if that risk is not acceptable. See Updates.

HTTPS

HTTPS protects credentials and application traffic in transit. Tailscale HTTPS is the recommended approach because it avoids public exposure and provides a browser-trusted certificate.

Reporting a vulnerability

Avoid publishing secrets or exploitable details in a public issue. Contact the repository owner privately when sensitive disclosure is required.