Security

There is no login. What that means, and what to do about it.

everyoneAssumes a home network and that you have heard of DNS.page 11 of 24

There is no authentication. Not a weak default, not a setting left off: the product has no login and no accounts at all.

Why it ships this way#

It is a single-household tool on a trusted LAN, and an auth system nobody asked for is an auth system nobody maintains: a password field, a session store, a reset flow and a lockout policy, all of it written by one person and none of it audited. The considered position is that no authentication with a clear warning is more honest than weak authentication that feels like a lock.

That reasoning holds exactly as long as the thing is not reachable from the internet.

LAN only

Everyone on your home network

The default, and the right answer for almost everybody

Behind a VPN

You, from anywhere

WireGuard or Tailscale. An hour of work, once

Port forwarded

Anyone on the internet

Ninety days of the household's browsing, and the control screens

There is no authentication, so reachability is the entire access control model. The first two rows are the supported deployments; the third is the one this product asks you not to do, and it is a router setting rather than anything you can configure here.

The three sane deployments#

Setup	Good for	Effort
LAN only, no port forward	Almost everybody	Nothing: this is the default
Behind a VPN (WireGuard, Tailscale)	Reading it from outside the house	An hour, once
Reverse proxy with real auth in front	Sharing it with a housemate	Caddy or nginx with basic auth or an OIDC forwarder

A minimal Caddy front end#

dns.home.example {
  basic_auth {
    hunter $2a$14$...bcrypt-hash...
  }
  reverse_proxy 127.0.0.1:3000
}

Caddyfile — TLS and a password, in six lines.

Generate the hash with caddy hash-password. Bind the app to 127.0.0.1:3000 in the compose file so it is not reachable except through the proxy.

What never leaves the box#

Queries, domains, device names and addresses. There is no telemetry of any kind.
Enrichment is entirely local: the company and geolocation datasets are files on disk, and no lookup is a network request.
The only outbound connections are to your resolver, to whatever notification service you configure, and to fetch filter lists when you ask it to preview one.

The credentials it holds#

Your AdGuard Home admin username and password, in .env at chmod 600. They are needed because AdGuard Home’s API has no read-only role. Anyone with shell access to the box can read them, which is the same statement as “anyone with shell access to the box can read the query log directly”.

Reporting something#

Open a private security advisory on the repository rather than a public issue. The threat model is narrow but the data is sensitive, and a bug that lets an unauthenticated visitor read the store from outside the LAN is worth handling quietly first.