mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-11 22:38:54 +00:00
1c62036ed2
The example compose file shipped with ADMIN_NAME/ADMIN_EMAIL/ADMIN_PASSWORD filled in, so the entrypoint created the first administrator and nobody ever reached the setup screen the README, the Docker Hub page and the website all promise. Someone who followed the instructions literally — edit APP_URL and the passwords — also ended up with a publicly reachable administrator on admin@example.com with a password printed in a public file. Comment the three variables out. Unattended provisioning still works for anyone who wants it, it is just opt-in now, and the first thing a new install shows is the setup screen again. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>