Never commit secrets.env, SSH private keys, generated JSON feeds, access logs, or wallpaper media. The included .gitignore excludes the expected paths, but review every commit before pushing.

The website analytics bridge reads Apache access logs and writes recent visitor IP addresses to website.json. Only expose RackThing on a trusted network, and disable that integration unless you understand the privacy implications.

Use a dedicated, least-privilege Home Assistant token. Protect the connector and Car Thing SSH keys with restrictive file permissions. Populate a dedicated known_hosts file rather than disabling SSH host verification.

Please open a GitHub security advisory rather than a public issue.