@cpcnw probably? But the software is old, so it does not implement all of the most recent advancements. It does not use PHP’s password_hash [1] with a modern hashing standard for passwords, nor does it try to address CSRF in a way possible thanks to modern browser changes [2].

Whether those things are an issue the way you are planning to host NNF, only you can decide.

[1]: https://www.php.net/manual/en/function.password-hash.php
[2]: https://www.alexedwards.net/blog/preventing-csrf-in-go