Logbox is a local / self-hosted demo and SMB-oriented stack, not a hardened multi-tenant SaaS.
| Item | Default | Action |
|---|---|---|
| Grafana admin | admin / admin |
Change password on first login; set via env in docker-compose.yml |
| Alert contact points | Placeholder email + Slack URL | Edit platform/grafana/provisioning/alerting/contact-points.yml |
| Network bind | Host ports 3000, 3100, 12345 |
Do not expose to the public internet without auth/TLS |
| Docker socket | Mounted into Alloy (read-only) | Expected for container log scrape; treat the host as trusted |
If you find a vulnerability in this repository’s scripts or config (not in upstream Grafana/Loki/Alloy), open a GitHub issue with a minimal reproduction — or contact the maintainer privately if disclosure is sensitive.
For upstream components, report to the respective Grafana Labs security channels.
- No authentication on Loki by default (
auth_enabled: false) - No TLS termination included
- Synthetic log generators are for demos only
See docs/operations.md for a production-ish checklist.