Report a problem
Please report security problems privately, not in a public issue, to security@filamama.com. Include what you found, how to reproduce it, and the version. You'll get an acknowledgement, and news while it is fixed. Please give us a reasonable window to ship a fix before disclosing publicly.
Supported versions
Filamama is pre-release. Security fixes land on the latest 0.1.x.
What the server exposes
- One HTTPS listener on the home network, port 5400 by default, with a self-signed certificate. Phones pin the server's key at pairing.
- The certificate and the pairing QR code advertise only real home network addresses and the local mDNS name. VPN, container and link-local addresses are kept out.
- No outbound traffic.
See Home network only and Privacy.