Using an off-the-shelf software like #vufind is nice and all - but boy, oh boy, what an attack surface! All these controllers and routes exposed to the web.

Time to trim the module.conf I guess...