On Android 11+, the OS sandboxes external storage by default. Without All Files Access (MANAGE_EXTERNAL_STORAGE) granted, some devices — Samsung especially — will let A-SWDAV list folders but silently hide regular files. If your file browser shows folders but no files, this permission is the fix: Settings → Apps → A-SWDAV → grant All Files Access, or accept the in-app prompt.
HTTP Basic Auth, checked against a SHA-256 hash of the stored password — plaintext passwords are never persisted. Turning auth off in Settings removes the login check for every request; only do this on networks you trust completely.
Every file operation resolves the requested path and checks it's still inside the configured server root before touching disk (a canonical-path prefix check). Requests trying to escape the root (../../etc/passwd-style) are rejected — except for admin accounts, which are explicitly allowed full filesystem access by design.
The Admin user flag (see Settings & Users) is a deliberate trust boundary: admins can browse storage mounts and any path the OS permission allows, non-admins are confined to the configured server root. Grant Admin only to accounts you trust with the whole device.
Self-signed TLS means there's no certificate authority vouching for the connection — clients will show a trust warning on first connect. This is expected; verify you're connecting to the right IP before accepting. There's currently no built-in certificate-pinning or trust-management UI on the server side — trust decisions happen client-side.
If HTTPS is off, all traffic — including Basic Auth credentials — travels in cleartext on the local network. Anyone with passive access to that network segment can read them. Use HTTPS, or only run on networks you control.