REMINDER: Do not expose CrossWatch directly to the public internet

[cenodude]

I notice that some users are hosting CrossWatch on remote VPS/dedicated servers. That can be fine but only if you treat it like a private service, not a public website!

If you put CrossWatch on a public IP without proper controls, you’re basically hanging a exploit sign on it.
Internet scanners will find it, and if there’s even one weak spot, it won’t stay yours for long.

At the current stage of development, CrossWatch is primarily focused on getting things done: features, stability, and usability.
It is not primarily focused on being a hardened, internet-facing service.

That means:

• Security hardening is not yet the main priority
• The app lacks common protections you’d expect from production-grade public services (such as aggressive rate limiting, hardened auth/session handling, defense-in-depth defaults, extensive security testing, audits, etc.).

As described in my disclaimer: https://wiki.crosswatch.app/related-information/disclaimer

Security

Do not expose CrossWatch directly to the public internet.

CrossWatch is intended for LAN/VPN use and may contain security weaknesses.

Putting CrossWatch on the public internet turns it into a target for automated scanners and real attackers. If there are any weaknesses—common ones in self-hosted apps include auth bypasses, weak session handling, missing rate limits, insecure defaults, outdated dependencies, or simple bugs, an attacker can use them to:

• Get unauthorized access to the UI and any data it can reach.
• Steal credentials/tokens if traffic isn’t properly encrypted end-to-end.
• Abuse the service (brute-force logins, spam requests, DoS) if there’s no throttling/WAF.
• Exploit known CVEs in the stack (framework/libs) the moment your instance is discoverable.

Therefore:

• Keep CrossWatch off the public internet (no direct exposure, no port-forwarding).
• Prefer binding to localhost / LAN only and restrict access with your firewall.
• For remote access, use a VPN (WireGuard/Tailscale) rather than opening ports.
• Enable UI authentication
• Enable HTTPS/TLS (recommended).