Update security document

SECURITY.md

@@ -16,6 +16,22 @@ During the beta phase we are making use of Node.js and its rich ecosystem of npm
 
 The lack of authentication on the logs page means that, in the correct circumstances, if someone could convince you to visit a malicious website, the website may be able to read the logs of your Umbrel.
 
+**Assuming the local network is secure**
+
+Umbrel currently makes the assumption that the local network is secure. This means local network communication is unencrypted using plain text HTTP. (Remote access via Tor is encrypted)
+
+This is pretty much the industry standard when it comes to locally networked devices. All routers and smart devices that expose a web interface work this way. Bootstrapping a secure connection over an insecure network and avoiding MITM attacks without being able to rely on certificate authorities is not an easy problem to solve.
+
+However, we think we can do better and have some interesting ideas on how to make Umbrel safe to run even when the local network is untrusted.
+
+**Hardcoded app passwords**
+
+We use hardcoded passwords for apps that support password authentication. These hardcoded passwords aren't providing any actual security, they are there to prevent "annoying sibling" level attackers.
+
+We plan to resolve this by implementing SSO authentication across all apps. We can implement this at the Umbrel level transparently without any modifications required from individual apps.
+
+This means all Umbrel apps exposing a web interface will be protected by your Umbrel dashboard password.
+
 **SSH password of Umbrel OS.**
 
 Umbrel OS's current SSH password is same for all Umbrel OS users. In the future we'll have it automatically change to the user's dashboard password, but for now if a malicious actor is on the same network as your Umbrel node (running Umbrel OS), they could SSH into your node using the publicly available password. For that reason, we recommend advanced users to manually update their SSH password.