Please report security issues privately via GitHub Security Advisories rather than a public issue. You'll get a response within a few days.

HighWater is a local-first monitoring daemon. Design decisions that matter:

• Data never leaves the machine — alerts carry check messages, never row data.
• SQLite sources open read-only; check SQL runs through prepared statements. Table/column identifiers are validated (assertSafeIdent) before being spliced into engine-generated queries. Operator-supplied SQL (sql checks, where) is trusted by design — whoever can write the config can already run queries.
• Dashboard auth: when api_token is set, all /api/* routes require it (Bearer header, cookie, or ?token=). Static SPA assets stay public so the login-by-URL flow works. Run serve behind a reverse proxy with TLS for any non-loopback exposure.
• Env expansion is explicit: ${VAR} references that don't resolve are hard config errors, never silent empties.