Private by default. The API binds 127.0.0.1:8300; workers bind 127.0.0.1:8310-8399; the console binds 127.0.0.1:8301. Only the WireGuard-connected gateway (Caddy on BHS64) reaches port 8300 over the tunnel; nothing else is exposed.
Admin auth: single admin user, argon2 password hashes, signed session cookie (itsdangerous, HttpOnly, Secure behind HTTPS, SameSite=Lax, 14 days). First user is seeded from ADMIN_EMAIL/ADMIN_PASSWORD or created once via /api/auth/setup (only when no user exists). Login rate limit 8/min/IP. Password change requires the current password.
CSRF: session-authenticated mutations require header X-LLM-CSRF: 1 and, when an Origin is present, it must match the public URL / host.
API keys: llm_live_ + 40 random chars, stored as SHA-256; only the prefix is displayed after creation. Scopes inference / admin. Revocation is immediate. Per-key last-used and request counters.
Path safety: repository ids validated (org/name, no ..); model deletion refuses paths outside the model root; scanned paths are only read.
No shell from the API: workers are started with subprocess.Popen(list) (no shell); user-supplied extra llama args are filtered (`|;&$`` rejected) and only settable by an admin.
Secrets: .env is 600 and outside the repo; HF_TOKEN only reaches the downloader; the session secret is generated into data/.secret (600). Keys, passwords and tokens are never logged.
Prompt privacy: LOG_PROMPTS=false by default; when enabled, prompts/completions are stored truncated in inference_requests.
Audit log: login/failed login/password change, key create/revoke, model load/unload/update/delete, downloads, harvest scans, settings changes, server start/stop — with actor and IP.
Headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, Cache-Control: no-store on API paths. Console is noindex.
Memory safety is part of security here: a model that would exhaust unified memory is refused before any allocation; swap use raises a warning alert; workers are killed on unload so memory always returns.