Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
HouseCairn
HouseCairn, home of the documentation HouseCairn, home of the documentation
  • English
  • Français
  • Getting started
    • Install with Docker Compose
    • First start
  • Guides
    • Rooms and items
  • Screen reference
    • Start page
    • Sign-in
    • Account pages
    • Homes
    • Add a home
    • Home
    • Household and roles
    • Audit log of a home
    • Member
    • Invitation
    • Instance administration
    • Instance invitation
    • Rooms
    • Room
    • Add or edit a room
    • Room memory
    • Item
    • Add or edit an item
    • Add a photo
    • Search
    • More
    • About
  • API
    • API reference
  • Administration
    • Environment variables
    • Reverse proxy
    • Rate limits
    • Single sign-on (OpenID Connect)
    • Instance administrator
    • Open sign-up
    • Email
    • Export and deletion
    • Data and backups
    • Update
    • Hardening
  • Integrations
  • Security
    • Verify the image
    • Report a vulnerability
  • Developer
    • Architecture
    • Architecture decisions
      • 0001. Record architecture decisions; runtime dependencies
      • 0002. A single service layer for web and API
      • 0003. Web/API parity, checked by a test
      • 0004. Versioned REST API, OpenAPI 3.1, cursor pagination
      • 0005. UUID identifiers, timestamps, soft deletion
      • 0006. Every query scoped to the user’s homes
      • 0007. django-allauth, scoped API tokens, OAuth 2 later
      • 0008. Background tasks with django-q2 and the ORM broker
      • 0009. Design tokens in one JSON file
      • 0010. Stable addresses for every record
      • 0011. No external resources, strict CSP
      • 0012. Configuration by environment, safe defaults
      • 0013. English source, French shipped, no hard-coded strings
      • 0014. Continuous integration and supply-chain security
      • 0015. Container image and its publication
      • 0016. Documentation site
      • 0017. Visual system, brand and application shell
      • 0018. Sign-in page: passkeys without a button, one button per provider
      • 0019. Property-based tests with Hypothesis
      • 0020. Household roles and invitations
      • 0021. Single sign-on required per home
      • 0022. Instance administrator without access to content
      • 0023. Audit log, export, erasure and security emails
      • 0024. Open sign-up and its anti-robot check
      • 0025. Rate-limit counters and several web processes
      • 0029. Rooms, items and room memory
      • 0030. Photo storage and processing
      • 0036. Export of rooms and photos, erasure of files with the home
      • 0040. Merge queue
    • Contributing
  • Release notes
Back to top
  1. Home
  2. Security

Security¶

HouseCairn sends no telemetry, makes no outgoing connection unless you configure one, and loads no resource from another host. Its images are signed, and vulnerabilities are reported privately.

  • Verify the image
  • Report a vulnerability
Edit this page on GitHub Report a problem with this page
Next
Verify the image
Previous
Integrations
Copyright © 2026 Robvred
Made with Sphinx and @pradyunsg's Furo

HouseCairn is free software under the GNU Affero General Public License v3.0 only. The name and the logo are not covered by the licence. Developed with an AI coding agent, under human review.

Licence Notices Source code