Security

How to report a problem, how Baumeister protects your computer, and what it can't protect you from.

Report a security problem

A person reads every report. We reply within 3 business days, tell you what we found, and say when a fix ships. If you'd like credit, we'll name you in the release notes.

Please include what you did, what happened, and the Baumeister version (Help > About). Give us a chance to fix it before you publish, and don't touch other people's sites or data while testing. Your own copy of Baumeister and your own sites are fair game.

To report a site hosted with Baumeister for phishing, malware or abuse, use the Report link at the bottom of that site, or email the same address with the site's address.

How Baumeister keeps your computer safe

Nothing on your computer is opened to the internet. Baumeister doesn't ask you to open router ports. Your computer makes one outgoing, encrypted connection to Cloudflare (a Cloudflare Tunnel), and visitors reach only the projects you publish, through it.
The control panel isn't on the internet. On a PC or Mac it only listens on your own computer (127.0.0.1). On a Raspberry Pi or a Baumeister server it also answers on your home network, so you can manage it from another computer there; a Baumeister server's firewall turns away everything outside your home network. It can't be reached through the tunnel. It refuses requests from other websites (cross-site requests and DNS rebinding are blocked). From outside your home, the only way in is Remote Access. It's off until you turn it on (a Baumeister server turns it on during setup), and it needs a password and a code from an authenticator app.
Hidden files are never published. Even if they sit inside a published folder, Baumeister never shows visitors .env files, .git folders, private keys, database files or backup copies. An app's source code is never shown as files, even while the app is stopped.
Checks before anything goes public. Before you publish, Baumeister looks for API keys and passwords written into your files, debug modes that would let a visitor run code, and admin pages with no sign-in. It tells you in plain words.
Your keys are kept out of Baumeister's files on a PC or Mac. They go in your computer's own keystore (Windows Credential Manager or the macOS Keychain). A Raspberry Pi or Baumeister server has no keystore yet, so there they're kept in Baumeister's data file, which only Baumeister's user account can open. Your AI key goes straight from your computer to the AI company you chose, never through us, and backups leave keys out.
Signed downloads and updates. The Windows installer is code-signed by Baumeister Private Server, Inc. The Mac app is signed and notarized by Apple. App updates are checked against that signature before they install. From version 1.2.17, updates for Baumeister servers also carry a separate signature from a key that never touches GitHub, so a hacked GitHub account couldn't push one.
A Report link on every hosted site, so abuse can be reported and taken down quickly.

What Baumeister can't protect you from

We'd rather you hear these from us:

Cloudflare sees your visitors' traffic. It handles the HTTPS connection, the same as for any site behind Cloudflare. See How it works for who sees what.
Apps you host run as you. A Python or Node app you publish runs on your computer with your user account's access, like any program you start. It isn't sandboxed yet, so an app that was hacked could read your other projects, your files, and the keys Baumeister keeps. We're adding a sandbox, starting with Raspberry Pi and Baumeister servers. Until then, host code you trust, keep its packages up to date, and use a visitor password for anything private.
Your computer's safety is still yours. Keep your system updated, use a sign-in password, and keep backups. Baumeister can't protect a computer that's already compromised.
Your sites are only as safe as what's in them. Baumeister warns you about common mistakes, but it can't review every line of an app.

Check your download

Each release lists its SHA-256 checksums on GitHub. These are the current ones:

Loading the latest checksums from GitHub…

To check a file you downloaded, compare its checksum with the list above.

Windows (in PowerShell, in your Downloads folder):

Get-FileHash .\Baumeister-Setup-*.exe -Algorithm SHA256

Mac (in Terminal):

shasum -a 256 ~/Downloads/Baumeister-*.dmg

On Windows you can also right-click the installer, choose Properties > Digital Signatures, and check that it's signed by Baumeister Private Server, Inc.