It's also possible to move the listener to a permission-protected unix socket https://docs.syncthing.net/users/config.html?highlight=unix%20socket https://docs.

It's also possible to move the listener to a permission-protected unix socket https://docs.syncthing.net/users/config.html?highlight=unix%20socket https://docs.syncthing.net/users/config.html?highlight=unix%... Pity that I don't know of any browser that readily supports HTTP over a unix socket (nginx can proxy_pass it, but then you're back to a TCP listener). But a multi-user install could reasonably lock things down in that way, though the defaults definitely favor "works out of the box on a single-user machine".