Please do not publish exploit details for an unpatched security issue in a public GitHub issue.
For deployments:
- keep the broker behind HTTPS;
- restrict broker network exposure;
- use a strong random
CODE_PEPPER; - restrict
ALLOWED_SERVER_REGEX; - use a dedicated Windows/AD helper group;
- require end-user consent;
- retain broker logs only as long as necessary.
The current MVP intentionally has no API authentication. Treat that as a deployment constraint, not as an Internet-facing security boundary.