Security

The settings page binds to 0.0.0.0:8099 with no authentication, and shell sources can run with root: true — meaning anyone on the same network can execute root commands via the config. Set "configToken", or disable "configServer", on any network you don't trust.
```
"configToken": "secret"      // then open http://<phone-ip>:8099/?t=secret
```
Static assets are deliberately outside that gate: /fonts/, /i18n.js, /icon.svg and /icon-180.png answer without a token, because the browser requests them before the page can attach one. They contain no configuration — only fonts, UI translations and an icon. Everything that reads or writes config, state or the device stays behind the token.
ntfy.sh topics are public — anyone who knows the name can read your notifications and push messages to your screen. Use a random name (the "+ topic acak" button), an access token, or your own ntfy server. See notifications.
Root is pre-granted to the app's uid in magisk.db; revoking it stops the dashboard from being able to claim the cover screen. See install.

Navigation Menu