Security and HTTPS #

• Web app runs on HTTP only (http://localhost:8080)
• Do not expose to the internet: Passwords and DB credentials are sent from browser to app server unencrypted
• For production: Use a reverse proxy (NGINX, Apache, Caddy) with HTTPS

Example NGINX:

location / {
    proxy_pass http://localhost:8080;
}