• UI/API binds to loopback by default.
• A non-loopback API listener requires api.auth_token_file; requests use Bearer authentication.
• Panel passwords and tokens are read from separate files rather than embedded in the main JSON configuration.
• HTTP response security headers and a restrictive Content Security Policy are enabled.
• Request bodies are size-limited and JSON decoding rejects unknown fields.
• Configuration writes use a temporary file + fsync + atomic rename and mode 0640.
• The service runs as root only because Linux traffic control requires network-administration privileges. The systemd unit applies NoNewPrivileges, a capability bounding set and filesystem protections.
• nftables changes are isolated to the inet xui_bw_guard table.
• qdisc takeover is opt-in and cleanup is ownership-aware.

For remote UI exposure, use TLS at a reverse proxy and an API token. Prefer an SSH tunnel for administrative use.