Security explains how Binions protects a host — its network exposure model, OS-level isolation, secrets, licensing protections, the software supply chain, and how to report a problem.
Binions is built to run safely on a single Linux host. Everything internal talks over localhost, a default-drop firewall keeps all but the front door closed, and each daemon runs as its own locked-down user. This section covers the model and the practical steps to keep your deployment hardened.
The short version. Only the Traefik web edge is meant to be public. Object storage, tracing, and admin tools stay on your LAN; each daemon's health and metrics stay on loopback. Keep it that way and put your own firewall in front of the edge.