open-fp runs on a home LAN: the web UI on the Arduino UNO Q has no authentication and is meant only for a trusted local network. Don't expose port 7000 to the internet.

Please don't open a public issue. Report it privately through GitHub: on the repository's Security tab, choose Report a vulnerability. Include what you found, how to reproduce it, and what an attacker could do with it.

You should get a reply within a week. Fixes go into main. There are no separate release branches.