every time i feel paranoid about whether or not i've secured my self-hosted stuff well enough, i just take a gander over to VNC resolver.

Always makes me feel better when someone can leave their homeassistant accessible via passwordless VNC since 2025, still running 2025.4.4 because they never updated it ever, apparently with no password enabled for cli access.

and somehow it's still there over a year later without going down.

i'd be surprised if it's not part of some kind of botnet though.