Vulnerability: Default configuration allows to download the htpasswd file over HTTP

[ypid]

Hi

in the default configuration, it is pretty easy to download the htpasswd file containing the hashes of the user passwords.

See: nginx configuration

[jaysh]

Assuming you already have the password. If you already have the password, you don't actually need to open the .htpasswd file to get the password :-)

Until the time comes where multiple user accounts are supported, I'd close this as a non-issue or leave it as an enhancement. That said, I'm sure the author won't decline a PR to fix it 👍