Care to elaborate on both counts? I’ve been using it for years and have had no auth issues in my use case at least. I mainly use it inside lan only though I do have a firewalled instance for a couple public services I host, but I haven’t heard of any security issues, I sort of assumed it had a similar attack surface as regular Nginx as that’s basically all it is.