HomeGenie is a programmable automation server. Its administration and scripting features can control devices, install packages, and execute code with the permissions of the operating-system account running the service. Treat access to the server as administrative access, and grant it only to trusted users and client devices.
Protect access before connecting client devices
A fresh installation has no password configured. Without password protection, any client device that can reach the HTTP service can access its API, including administration and program execution. A private LAN is not an authentication mechanism: guests, shared computers, and other connected devices can still reach the server.
Perform initial setup from a trusted computer on a restricted network, or locally on the server machine. Before allowing other client devices to connect:
- Open the Maintenance section from the main application menu.
- Under Service configuration, select the HTTP options.
- Activate the Password protected access setting.
- Set a strong, unique password and click the Confirm button. By default, the username is "admin".
- Open a private browser window to verify that access now requires authentication. Then configure your mobile apps and API integrations with these same credentials.
These security controls are located in Maintenance: completing the initial Setup Wizard does not configure a password on its own. If you deliberately leave password protection disabled on an isolated test system, you must ensure every device on that network is fully trusted.
Always configure passwords through the web interface instead of placing them in URLs, terminal commands, screenshots, or support logs. Changing the password may require reconnecting existing client devices.
Use a dedicated, unprivileged account
Run HomeGenie under a dedicated non-root account on Linux, and without administrator privileges on Windows. Avoid using the "sudo" command for everyday operations. Administrative rights required to install a service should not be granted to the ongoing background process.
Give the account write access to the HomeGenie installation directory and its specific data storage paths. Keep personal files, credentials, and broader system files outside these writable directories. A dedicated account limits privileges, but it does not act as an isolated sandbox that automatically blocks all file reading or network requests.
Grant hardware access through the appropriate device permissions or system groups rather than running the entire service as root. Custom programs, including AI-generated scripts, execute with this account's permissions: always review code and package sources before running them.
If you deploy HomeGenie in a container, avoid privileged mode, broad host-directory mounts, and mounting the container engine socket. Verify the actual write requirements for your setup: configuration files, programs, logs, and application updates may need writable locations beyond the "data" directory. Always test hardware communication and update workflows with these restricted permissions.
Restrict network exposure
Keep the HomeGenie service on a trusted network and use firewall rules to limit which devices can reach its configured port. Avoid forwarding that port directly on your Internet router. For remote access, prefer a secure VPN with access restricted to the users and devices that need HomeGenie.
Use HTTPS when accessing HomeGenie across an untrusted network. HTTPS protects traffic in transit, but it does not replace password authentication. If you terminate HTTPS at a reverse proxy, keep HomeGenie's authentication enabled and prevent client devices from bypassing the proxy to reach an unprotected backend. Do not assume that securing the proxy automatically protects a separately accessible HomeGenie port.
Maintain and verify your installation
- Keep HomeGenie and all installed packages up to date, and review release notes and security advisories.
- Install programs and packages only from sources you trust, and inspect generated automation code before running it.
- Treat backup archives as sensitive files: they contain configuration details, credentials, and custom code. Restrict file access and store a recovery copy outside the installation directory.
- After restoring a backup, verify password protection, service options, and network exposure before reconnecting client devices.
- Recheck access permissions after any changes to your router, firewall, reverse proxy, service account, or hardware groups.
Confidential vulnerability reporting
Use the GitHub private vulnerability reporting feature to submit suspected vulnerabilities directly to the maintainers. Include the affected version, configuration prerequisites, reproduction steps, and observed impact. Remove passwords, API keys, and personal data from all attachments. Never disclose unpatched vulnerabilities or exploit details in a public issue tracker.
The system service instructions explain Linux account setup and provide a systemd configuration template. Review SECURITY.md to read our full vulnerability disclosure policy and response guidelines.