The direct client-to-hub architecture eliminates intermediate proxies, but places authentication credentials on the Android device running KWGT.

Primary security risks:

1. Exporting or sharing presets containing live credentials;
2. Unencrypted cleartext HTTP traffic across untrusted networks;
3. Using an administrative account with write/delete capabilities;
4. Leaking tokens into UI debug text strings or crash reports;
5. Device compromise / physical access;
6. Exposing Beszel Hub to the public internet without proper access control.

Create an account strictly dedicated to the widget:

• Role: Read-only;
• Restricted scope: Access limited only to monitored systems;
• Unique, high-entropy password;
• No password reuse.

Mandatory transport standards:

• HTTPS with valid TLS certificates;
• Tailscale / WireGuard or private VPN tunnel;
• Existing trusted reverse proxy (e.g., Caddy, Traefik, Nginx).

Never send credentials over unencrypted HTTP.

Utilize Kustom Secret Globals for:

• bz_email
• bz_pass
• bz_token

bz_url can remain a standard text global unless the internal domain itself is considered sensitive.

Permitted debug outputs:

HTTP 401
system=<sanitized-id>
cache_age=7m
view=overview

Strictly prohibited in debug strings or UI elements:

password=...
Authorization=...
token=...

Before publishing or sharing a .kwgt file:

• Flush all credential globals;
• Clear JWT tokens;
• Scrub internal IP addresses and hostnames;
• Flush cached JSON payloads;
• Review any exported screenshots for confidential information.

Because KWGT operates as a headless Android client without interactive OAuth or background HTTP POST body capabilities, the widget uses a long-lived JWT token generated via setup.py and treated as an API Key / PAT.

• Advantage: Password never touches the mobile device; zero background credential storage risk.
• Durability: Configured for 1 year (31536000s) in PocketBase, providing a true "Set & Forget" user experience.
• Revocability: Can be instantly revoked on demand from the PocketBase Admin dashboard ("Invalidate all previously issued tokens") if the mobile device is replaced or lost.
• Privilege Isolation: We recommend pairing with a dedicated read-only Beszel user rather than primary superuser credentials.

This blueprint explicitly advises against:

• Bypassing PocketBase authentication rules;
• Publicly exposing unauthenticated metrics endpoints;
• Storing admin/root credentials on mobile;
• Disabling SSL/TLS certificate validation;
• Opening firewall ports directly to the public internet solely for widget access.