No REPORT_PASSWORD set in .env — this dashboard is open to anyone who can reach this URL. Set REPORT_PASSWORD in .env to require a login, or keep this bound to localhost / an SSH tunnel.