All of your complaints are specific to Syncthing which, admittedly, doesn't have great defaults (but the fans will be quick to defend it). A webui for a deskto

All of your complaints are specific to Syncthing which, admittedly, doesn't have great defaults (but the fans will be quick to defend it). A webui for a desktop app can be made perfectly securely, though. For example it can bind to 127.0.0.1, not do external network requests, and require a token (generated by a systray menu utility or an app shortcut for example) that will prevent automated exploits from accessing it as well as other users on a multi-user system.