Arbitrary project creation possible
In the current configuration, any random person in the Net can
- sign up (create an account)
- create projects without admin confirmation The latter can be prevented by declaring all users 'external' by default (see https://ohwr.org/admin/application_settings#js-signup-settings, section Account and limit) The former is trickier, and several options are available.