vince/ai-model-manager
1
0
Fork 0
Code Issues 16 Pull requests Projects Releases Packages Wiki Activity Actions

Security and local network hardening #14

New issue
Open
opened 2026-06-16 21:39:51 +02:00 by vince · 0 comments
vince commented 2026-06-16 21:39:51 +02:00
Owner
Copy link

Context:\nThis app can download arbitrary URLs and delete huge model files. It should not be exposed casually.\n\nRequirements:\n- Bind to localhost by default.\n- Require token/password when binding to LAN.\n- Store HF/CivitAI tokens with restrictive file permissions or OS keychain if available.\n- Redact secrets in logs.\n- Add CSRF protection for browser forms.\n- Clearly document threat model and non-goals.\n\nAcceptance criteria:\n- Fresh install is localhost-only.\n- LAN mode requires explicit config.\n- Secrets do not appear in logs, DB debug dumps, or UI job output.

Context:\nThis app can download arbitrary URLs and delete huge model files. It should not be exposed casually.\n\nRequirements:\n- Bind to localhost by default.\n- Require token/password when binding to LAN.\n- Store HF/CivitAI tokens with restrictive file permissions or OS keychain if available.\n- Redact secrets in logs.\n- Add CSRF protection for browser forms.\n- Clearly document threat model and non-goals.\n\nAcceptance criteria:\n- Fresh install is localhost-only.\n- LAN mode requires explicit config.\n- Secrets do not appear in logs, DB debug dumps, or UI job output.
vince added the
mvp
security
 labels 2026-06-16 21:42:29 +02:00
vince added this to the v0.1 MVP milestone 2026-06-16 21:42:29 +02:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
architecture

Architecture, stack, config, and core design

  
comfyui

ComfyUI image model management

  
metadata

SQLite/indexing, source tracking, and reconciliation

  
mvp

Required for the first usable local model manager

  
ollama

Ollama LLM model management

  
packaging

Build, installation, and service integration

  
post-mvp

Useful after the first usable version exists

  
security

Auth, secrets, network binding, and destructive operation safety

  
ux

Local web UI and operator experience

No labels
architecture
comfyui
metadata
mvp
ollama
packaging
post-mvp
security
ux
Milestone
Clear milestone
No items
No milestone
v0.1 MVP
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: vince/ai-model-manager#14
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?