[kalfasyan]

Answers the open questions from the latest outside security review: internet exposure, the admin UI, backups you can restore, and what data the apps aren't meant for yet.

• security.md
  • New "Can I put the apps on the internet?" section: Tailscale yes; a public reverse proxy only with HTTPS, /_/ blocked, strong passwords and updates; a forwarded port never.
  • New "What not to keep in the apps yet" section: not the only place for passwords, bank details, identity documents or medical records, since the database isn't encrypted on disk and there's been no independent review.
  • The access rules row now says other Flowy users see only your name and role (flowy#26).
  • Two-step sign-in is added under "Not done yet", and "try a restore" under "Your part".
• phones.md: the Caddyfile example now blocks /_/ and /api/collections/_superusers/* with a reusable snippet, and a paragraph says how to reach the admin UI instead (Tailscale or an SSH tunnel) and what to do with a proxy that can't block paths (DSM).
• updates-and-backups.md: a "Restore a backup" section that covers the admin UI's Settings > Backups > Restore, a by-hand restore from a nightly zip or your own copy (with the chown for the plasto apps), and checking the result.

Merge after flowy#26 (the Flowy claim) and should-we#21 (should-we had no nightly backups). I couldn't run Caddy here; the snippet relies on respond running before reverse_proxy in Caddy's standard directive order.

---

Generated by Claude Code