local access
The password is verified on the server against the SHA-256 hash in .env. No account data is shown before that.