I suggest:
- Open source the server side, and have the client side require a server configured.
Done... absolutely even. My intention is so that anyone can run their own server either on the internet or on their local network. I am intending to have a download for a VM that has it fully configured and ready to go so if someone wants to run a full fledged "miner farm" they can.
- Ensure everything works if *pool commands are disabled (or at least addpool, if the user wants to actually change pools via the interface).
As I see it the device takes priority, server stuff always looses out to local configuration.
- Possibly accept direct access if the user wants to just forward a port.
Direct access always takes priority in my mind, nothing is ever "disabled" or anything on the local device, server access is an add on, not the other way around.
- Enforce secure passwords (using eg cracklib).
I will do what I can, from experience people can be rather dumb with what security features they choose to enable

. 2FA, Locked IP's, and brutal passwords are all going to be available (I would also like key-exchanges as well) but lets see what people actually activate

.
Neil