Security
How to report a problem, how Baumeister protects your computer, and what it can't protect you from.
Report a security problem
Email info@baumeisterprivateserver.com with "Security" in the subject.
A person reads every report. We reply within 3 business days, tell you what we found, and say when a fix ships. If you'd like credit, we'll name you in the release notes.
Please include what you did, what happened, and the Baumeister version (Help > About). Give us a chance to fix it before you publish, and don't touch other people's sites or data while testing. Your own copy of Baumeister and your own sites are fair game.
To report a site hosted with Baumeister for phishing, malware or abuse, use the Report link at the bottom of that site, or email the same address with the site's address.
How Baumeister keeps your computer safe
- Nothing on your computer is opened to the internet. Baumeister doesn't ask you to open router ports. Your computer makes one outgoing, encrypted connection to Cloudflare (a Cloudflare Tunnel), and visitors reach only the projects you publish, through it.
- The control panel only listens on your own computer (127.0.0.1). It can't be reached from your network or through the tunnel. It refuses requests from other websites (cross-site requests and DNS rebinding are blocked). The only way to reach it from elsewhere is Remote Access, which is off until you turn it on and needs a password and a code from an authenticator app.
- Hidden files are never published. Even if they sit inside a published folder, Baumeister never shows visitors
.env files, .git folders, private keys, database files or backup copies. An app's source code is never shown as files, even while the app is stopped.
- Checks before anything goes public. Before you publish, Baumeister looks for API keys and passwords written into your files, debug modes that would let a visitor run code, and admin pages with no sign-in. It tells you in plain words.
- Your keys stay in your computer's own keystore (Windows Credential Manager or the macOS Keychain), not in a file a program could copy. Apps you host don't inherit Baumeister's keys or settings.
- Signed downloads and updates. The Windows installer is code-signed by Baumeister Private Server, Inc. The Mac app is signed and notarized by Apple. App updates are checked against that signature before they install. From version 1.2.17, updates for Baumeister boxes also carry a separate signature from a key that never touches GitHub, so a hacked GitHub account couldn't push one.
- A Report link on every hosted site, so abuse can be reported and taken down quickly.
What Baumeister can't protect you from
We'd rather you hear these from us:
- Cloudflare sees your visitors' traffic. It handles the HTTPS connection, the same as for any site behind Cloudflare. See How it works for who sees what.
- Apps you host run as you. A Python or Node app you publish runs on your computer with your user account's access, like any program you start. It isn't sandboxed. Host code you trust, keep its packages up to date, and use a visitor password for anything private.
- Your computer's safety is still yours. Keep your system updated, use a sign-in password, and keep backups. Baumeister can't protect a computer that's already compromised.
- Your sites are only as safe as what's in them. Baumeister warns you about common mistakes, but it can't review every line of an app.
Check your download
Each release lists its SHA-256 checksums on GitHub. These are the current ones:
Loading the latest checksums from GitHub…
To check a file you downloaded, compare its checksum with the list above.
Windows (in PowerShell, in your Downloads folder):
Get-FileHash .\Baumeister-Setup-*.exe -Algorithm SHA256
Mac (in Terminal):
shasum -a 256 ~/Downloads/Baumeister-*.dmg
On Windows you can also right-click the installer, choose Properties > Digital Signatures, and check that it's signed by Baumeister Private Server, Inc.