Small enough to understand.

Security model

A single, restricted container

One Go executable serves the embedded frontend and stores data in SQLite. The container runs as UID/GID 65532 with a read-only root filesystem, dropped Linux capabilities and no-new-privileges. It does not need the Docker socket. Only the named data volume, which holds the database and uploads, is writable.

One local administrator

The first visit creates the administrator account; there are no default credentials. Passwords are hashed with argon2id. Sessions use HTTP-only, same-site strict cookies, marked Secure when HOMEGRID_SECURE_COOKIE is enabled. Every state-changing request needs a CSRF token and a matching origin, and sign-in and password changes are rate limited. Sessions end seven days after their last use and always 30 days after sign-in; background refreshes of an open dashboard do not keep them alive. Changing the password requires the current one and signs out all other sessions.

Restrictive browser policy

Responses carry a Content Security Policy that only allows scripts and styles from HomeGrid itself, deny framing and send no referrer. Uploads are limited to validated PNG, JPEG and WebP images, and icons are limited to bundled IDs, uploads or the service's own favicon; arbitrary icon URLs are rejected.

Nothing leaves your network

HomeGrid has no telemetry, analytics or cloud dependency. Bundled logos, icons and backgrounds work offline. The backend contacts a service only when you add one whose logo is not bundled, or press From service: it asks that URL once for its icon, refusing loopback, link-local and multicast addresses at connect time, verifying certificates and storing a re-encoded copy. Optional status checks, off by default, send one HEAD request per application address at most once a minute under the same address rules, follow no redirects, read no response and keep no history. The optional browser favicon is requested by your browser directly from the service origin.

What remains your responsibility

• Transport. Direct port access is plain HTTP. Use an HTTPS reverse proxy for any untrusted network and set HOMEGRID_SECURE_COOKIE=true. See LAN access and HTTPS.
• Setup. Complete administrator setup from a trusted network before exposing the installation.
• Data. Protect access to the dashboard, the data volume, backups and JSON exports. Exports contain no secrets but can reveal internal service names and addresses.
• Updates. Keep the container image current. Security fixes target the latest 0.1.x release.

HomeGrid deliberately has no multi-user management, external identity provider, recovery email or plugin system.

Report a vulnerability privately

Use GitHub private vulnerability reporting. Please do not open a public issue containing vulnerability details.

Include the affected version, deployment method, expected and observed behavior, and a minimal reproduction using synthetic data. Remove passwords, session cookies, tokens, private service URLs, database files and personal data. The full process is described in the security policy.

Reports are assessed and fixes coordinated as capacity allows; there is no guaranteed response deadline or formal security certification.

Supply chain

• Pinned build inputs. GitHub Actions are pinned to full commit SHAs, and frontend dependencies install from a lockfile.
• Scanned before publishing. Each release candidate image is scanned with Trivy; known critical or high vulnerabilities with an available fix stop the release.
• SBOM and provenance. Release images for AMD64 and ARM64 are published to ghcr.io/bifrost0x/homegrid with an SPDX software bill of materials and build provenance attestations.
• Verifiable releases. Each release lists its image digest, so you can pin exactly the image you reviewed.

Third-party service logos are synchronized from a pinned upstream commit and keep their licenses. See the icon credits.