Network and privacy notes

• The toolkit has no analytics, account service or cloud remote relay. Stations, artwork, directory and weather providers receive direct requests from the radio's network address.
• Remote control is authenticated local HTTP on port 8770. Anyone who can capture that LAN traffic can obtain its bearer key. Use trusted home networking, no port forwarding, and never publish keys or backups.
• The original squeeze-transport helper listens only on 127.0.0.1:8875. HTTPS uses OpenSSL with CA and hostname verification and a TLS 1.2 minimum. It rejects HTTPS-to-HTTP redirects and private/LAN upstream addresses. Plain HTTP station URLs remain unencrypted.
• The helper bounds request/response headers, redirects, setup time and concurrent workers. Controlled tests cover malformed requests, chunked streams, redirects, untrusted certificates, hostname mismatch and worker saturation. These checks are not a full security audit.
• A valid radio clock and current CA bundle are required. Certificate failures are errors to resolve, never a reason to disable verification.
• The previous compatibility proxy disabled certificate verification. It is no longer active on the tested development radio and is excluded from the current source tree.
• Keep root SSH credentials private. Scope legacy SSH exceptions to the radio host. Never disable host-key checking as a general fix.
• Source excludes personal settings, Wi-Fi configuration, pairing tokens, Apple signing material and device backups. The weather example uses public city coordinates.

The firmware is old and a clean-device install is not yet verified. The replacement is a development build tested on one radio, not a security certification. Public distribution remains paused.