Your network is
the boundary.

The console speaks plain HTTP

The admin console runs on port 8080 over HTTP on the local network. That is a deliberate trade for zero configuration — no certificate to provision on a device that may never see the internet — and it means the network, not TLS, is your boundary.

• Put signage panels on their own VLAN, or a guest network with client isolation.
• Never port-forward 8080. There is no scenario in which exposing it is wise.
• Change the console password from its default before deployment.
• If the panels need no internet, and most do not, do not give them any.

The lockdown is not device-owner mode

The kiosk lockdown works without an MDM and without device-owner provisioning, which is what makes it deployable by a shop or a school. The cost is that the operating system is not enforcing it:

• The power button always works.
• Safe mode disables third-party apps.
• adb over USB opens the device if debugging is enabled.

Mitigate physically: an enclosure, USB debugging off, and a covered port. If your threat model needs OS-level enforcement, provision the device as device owner through an MDM and run UniKiosk as the board on top.

Email hello@unikiosk.io with the version, the device, and enough detail to reproduce it. We will confirm receipt and tell you what we intend to do about it.

Please give us a reasonable window before publishing. We do not run a bounty programme and will not pretend otherwise, but we will credit you if you want to be credited.

There is no hosted service to attack, so the interesting surface is the on-device HTTP server, the layout import path and the lockdown itself.