Skip to content

v0.65.3

Choose a tag to compare

@ulsklyc ulsklyc released this 07 Jun 10:27

Security

  • Documented the Umbrel first-run exposure: with the Umbrel reverse-proxy auth disabled (PROXY_AUTH_ADD: "false"), Oikos's unauthenticated bootstrap endpoint that creates the first admin is reachable by any LAN/Tor client until setup is completed. Added a caveat to deploy/umbrel/docker-compose.yml and the Umbrel README advising owners to finish setup immediately after install.