Security

tinykit is designed for self-hosted deployments where you control the server. This gives you full control over security, but also means you’re responsible for it.

Security Model

Since tinykit is self-hosted (one server = one team), there’s no multi-tenant isolation. All authenticated users can access all projects on that instance.

What’s Protected

Layer	Protection
Builder access	Pocketbase authentication required for `/tinykit`
API keys	Stored server-side in `.env`, never sent to browser
File operations	Scoped to workspace directory
Preview	Sandboxed iframe with restricted permissions
Database	Pocketbase with collection-level access rules

Built-in Protections

tinykit includes several security measures out of the box:

Authentication

Pocketbase auth with JWT tokens and automatic refresh

Path Traversal Protection

All file paths validated, ../ attacks blocked

Origin Checking

Cross-origin requests blocked for data APIs

Sandboxed Preview

Preview runs in isolated iframe with allow-scripts allow-same-origin

Server-side Secrets

API keys and credentials never exposed to client

Pocketbase Proxy

Database accessed via same-origin proxy at /_pb/

Production Checklist

Before exposing your tinykit instance to the public:

Protect the Builder

The /tinykit path gives full access to your codebase. Add authentication before going public.

Critical: Never expose /tinykit without authentication in production.

Use Environment Variables

Never hardcode API keys or secrets. Use .env for configuration.

LLM_API_KEY=sk-...

Enable HTTPS

Railway and most platforms provide HTTPS automatically. Never run without it.

Set Up Monitoring

Watch for unusual traffic patterns or error spikes.

Scheduling PocketBase Backups

Your PocketBase database (pb_data) contains all your data. Regular backups are essential.

Manual Backups

Access the PocketBase admin at /_pb/_ and use the built-in backup feature under Settings > Backups.

Automated Backups

Cron + Docker
Volume Snapshot

Create a backup script and schedule it with cron:

# backup.sh
#!/bin/bash
BACKUP_DIR="/path/to/backups"
CONTAINER="tinykit"
DATE=$(date +%Y%m%d_%H%M%S)

# Stop writes temporarily (optional, for consistency)
docker exec $CONTAINER /app/pocketbase/pocketbase backup

# Copy the backup
docker cp $CONTAINER:/app/pocketbase/pb_data/backups/. $BACKUP_DIR/

# Keep only last 7 days
find $BACKUP_DIR -name "*.zip" -mtime +7 -delete

Schedule with cron:

# Run daily at 2am
0 2 * * * /path/to/backup.sh

If using a named volume, back it up directly:

# Create backup
docker run --rm \
  -v tinykit-data:/data \
  -v $(pwd):/backup \
  alpine tar czf /backup/pb_data_$(date +%Y%m%d).tar.gz -C /data .

# Restore from backup
docker run --rm \
  -v tinykit-data:/data \
  -v $(pwd):/backup \
  alpine sh -c "cd /data && tar xzf /backup/pb_data_20231215.tar.gz"

Test your restore process before you need it. A backup you can’t restore is worthless.

Adding Authentication

To protect the /tinykit route, you have several options:

PocketBase Auth (Built-in)
Reverse Proxy
IP Whitelist

tinykit uses PocketBase for authentication. Create users in the PocketBase admin (/_pb/_) and they can log in to access the builder.

Email/password authentication
JWT tokens with automatic refresh
Per-user accounts

Add authentication at the proxy level (nginx, Cloudflare Access, etc.):

location /tinykit {
  auth_basic "Admin Area";
  auth_basic_user_file /etc/nginx/.htpasswd;
  proxy_pass http://localhost:5173;
}

Only allow access from specific IP addresses (good for internal tools).

location /tinykit {
  allow 203.0.113.0/24;
  deny all;
  proxy_pass http://localhost:5173;
}

Getting Started

Using tinykit

Deployment

Learn More

Security Model

What’s Protected

Built-in Protections

Authentication

Path Traversal Protection

Origin Checking

Sandboxed Preview

Server-side Secrets

Pocketbase Proxy

Production Checklist

Scheduling PocketBase Backups

Manual Backups

Automated Backups

Adding Authentication

Reporting Vulnerabilities

Report a Vulnerability

​Security Model

​What’s Protected

​Built-in Protections

Authentication

Path Traversal Protection

Origin Checking

Sandboxed Preview

Server-side Secrets

Pocketbase Proxy

​Production Checklist

​Scheduling PocketBase Backups

​Manual Backups

​Automated Backups

​Adding Authentication

​Reporting Vulnerabilities

Report a Vulnerability

Security Model

What’s Protected

Built-in Protections

Production Checklist

Scheduling PocketBase Backups

Manual Backups

Automated Backups

Adding Authentication

Reporting Vulnerabilities