Security

• AutoServer runs as root. The AI can change the whole server.
• Use a strong admin password; enable HTTPS and secure cookies after Caddy is up.
• Prefer starting with SSH tunnel access (no public URL) until you intentionally expose HTTPS.
• Never share your license key, LLM keys, or chat URL.
• One license key binds to one machine fingerprint. Copying /opt/autoserver alone will fail heartbeat on another VPS.
• Uninstall does not free the key — only dashboard Unbind does.
• Core downloads require a short-lived token after a successful bind.

This product is intentionally powerful. Treat it like handing someone root over SSH.

← Docs