Critical Vulnerability in Alby Hub: Funds Could Be Stolen if API Is Publicly Exposed

This is a reminder that self-custody software is only as secure as its deployment. The narrow condition—public API exposure—means the practical risk is concentrated among users who misconfigured their setup, yet the one confirmed case shows the stakes are real. For the broader Lightning ecosystem, it highlights how operational hygiene, not just code, determines fund safety. The open question is whether this incident prompts stricter default settings or clearer warnings in future releases, as the gap between affected and safe versions suggests the fix was already in circulation.