Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on bookmarks. and use the OpenAI key behind it. The server also had no automatic updates and three security updates waiting; the common role now installs unattended-upgrades with Debian's default security-only origins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>