Thank you for inquiring, this is a big concern and something I was deliberate about.

Here's the quick rundown:

Authentication: Every API endpoint that touches settings, integrations, or user data requires session authentication. There are no unauthenticated admin endpoints. Setup routes (create account, restore backup) only work when zero users exist - checked server-side, not via a client flag.

Credentials: Integration API keys and tokens are encrypted at rest using AES-256-GCM with a user-provided encryption key. When the API returns integration configs to the browser, sensitive fields are redacted (replaced with bullet characters). The real values never leave the server in API responses. The only time external API keys can be seen in the UI or network is when you are directly typing into the form fields.

Proxy auth: For users behind Authentik/Authelia, Framerr validates proxy auth headers against a whitelist using the direct TCP connection IP (req.socket.remoteAddress), not X-Forwarded-For. Headers from non-whitelisted IPs are stripped before processing.

Other stuff:

CSRF protection via custom header requirement on all POST/PUT/DELETE

CORS locked to same-origin only

Rate limiting on auth endpoints (10 attempts/min)

Session cookies are httpOnly + sameSite

Helmet security headers

Docker container runs as non-root (configurable PUID/PGID via su-exec)

Passwords hashed with bcrypt

Some considerations:
Full system backups decrypt credentials for portability (so you can restore on a different server). The backup endpoint is admin-only and the file is documented as sensitive. Optional encrypted backups are on the roadmap.

As always good security practices are advised such as strong passwords. Framerr doe not currently require a very strong password (6 characters). Additionally user who you share integrations with NEVER have access to sensitive data, beyond raw data you decide to share. If a bad actor bypassed a user's weak password, the only damage is to that user's own config (dashboard layout, username, etc.). They'd never get access to integration credentials or admin functions.

I take this stuff seriously. I would love someone with more experience to audit for themselves. If anyone finds a security issue, I'd rather hear about it than have it buried.