Self-hosting security notes
Open registration, what your server can see, and how to run it safely.
Last updated
Your server can’t read anyone’s vault. It still holds data worth protecting, and by default it is open to sign-ups.
Registration is open
The Docker server has no invite codes and no allow-list. Anyone who can reach it can create an account and store encrypted data on your disk. They can’t read your vault, but they can use your server.
The simplest protection is to make it reachable only by you: on a private network or VPN, or behind a firewall or proxy rule that allows only your own IP addresses. A password prompt in front of it (HTTP basic auth) won’t work, because the app doesn’t send one.
What your server holds
| Stored | Readable by the server? |
|---|---|
| Items and vault names | No, encrypted on the device |
| Email addresses | Yes |
| Device names and when each was last seen | Yes |
| IP addresses | Not stored by the Remem server, which doesn’t log requests at its default settings. Your reverse proxy’s logs have them. |
| Item count, sizes, edit times, deleted flags | Yes |
| Sign-in verifiers (not passwords) | Stored; they can’t be turned back into a password |
Deleted items stay on the server as small markers indefinitely. Treat the database and its backups as sensitive.
Good practice
- Never publish port 8788 or Postgres to the internet; keep TLS in front.
- Keep the host, Docker and your copy of the Remem source up to date.
- Sign-in attempts are limited to 10 a minute per client address, or per /64 block for IPv6. When the server’s table of recent clients is full, it drops the oldest one to make room rather than turning new clients away. Behind a reverse proxy, set
REMEM_TRUSTED_PROXIESto your proxy’s address, or all your users share one limit; see Run your own sync server. Trust only proxies you run. Sessions last 30 days. - Back up the database, and test a restore.
- Your Emergency Kit records the server address; keep the kit safe.
Found a security problem in the server? Write to security@remempass.org.
What if…
Someone else created accounts on my server
Restrict access as above. You can remove their rows from the accounts table; their devices, sessions, vaults and items are deleted with them.
Was this missing something? Write to hello@remempass.org.