A stolen asset register is a shopping list with names and addresses. Snipe-IT is well-built software, but its safety in your office depends on updates, logins and where you expose it. Here is the keeper's routine.
Think about what your Snipe-IT contains once it is alive: every device the company owns, its serial number, its value, and the name of the person holding it — plus your software licences and their keys. To a thief or a careless insider that is not an inventory, it is a targeting map. The project itself is actively developed and releases security fixes frequently, passwords are stored hashed (bcrypt), and it supports two-factor authentication and SAML login. But software cannot protect an installation whose owner stopped updating it and left it open to the internet. This final guide is the keeper's routine: update safely, lock the logins, and control who can even reach the door.
Snipe-IT releases often, and security fixes ride in those releases — an installation frozen at install-day version slowly becomes a known-vulnerable target with published instructions. The safe routine is unglamorous. Before any update, take the full backup set (database, uploads, .env — the backup guide in this set). Then apply the update by your route: Docker installs pull the new image and restart the containers; manual installs fetch the new code and run the dependency and database steps (composer install and php artisan migrate) that the upgrade notes specify. Read the release notes first — occasional versions need a newer PHP, and discovering that mid-update is the avoidable kind of drama. Then log in and click three screens before declaring done. Monthly cadence suits most offices; a published security fix shortens the wait to this week.
Because they do. Turn on two-factor authentication (Snipe-IT supports authenticator-app 2FA) for every admin and superuser account, no exceptions for the boss or the busy. Hold superuser accounts to two — one working admin, one break-glass — and give the IT team's daily work the narrowest permissions that allow it, so a phished technician login cannot rewrite history or export the fleet. Passwords are hashed with bcrypt by the software, which protects the database copy — it does not rescue a weak password from guessing, so length still matters. And audit the People list quarterly: accounts of leavers must be deactivated (kept for history, dead for login — the user guide in this set), because a departed employee's live login into the asset map is a small scandal waiting for its date.
The strongest login page is the one most people cannot see. Most offices need Snipe-IT reachable only on the local network (or over the company VPN for remote staff) — an asset register has almost no legitimate reason to be published to the open internet, and every day un-published is a day bots are not rattling it. Serve it over HTTPS even inside the LAN, with a real certificate where you can; the software sets secure, HTTPS-only cookies, and logins crossing the office in clear text are an own-goal on any network with a guest Wi-Fi. If a genuine need forces internet exposure, that is the moment for the full rigour: current version, 2FA enforced, and access restricted by firewall to known addresses — and a written note of why, reviewed yearly.
Two assets in this system outrank the data itself. The APP_KEY in the .env file decrypts the register's sensitive fields: it belongs in the password vault, in the backup set, and nowhere casual — never in a screenshot, a shared note, or a chat message during troubleshooting. And the backups themselves are complete copies of the map: an unencrypted backup on a shared drive hands the whole inventory to anyone who can browse the folder. Store backup sets where you would store the licence keys file — access-limited, and encrypted if they leave the building. Protecting a system includes protecting its spare copies; attackers and accidents both prefer the unguarded duplicate.
None of this is a project; it is a calendar entry. Once a month, ten minutes: check for a newer Snipe-IT release and apply it after a backup; glance at the admin and superuser list; confirm the last backup set is complete and off-server; confirm 2FA is still on for admins; note it all in one line in a log. Offices that keep this appointment never have the other kind of appointment — the one with an incident, a missing laptop list nobody can reconstruct, and an auditor asking who had access to the register. The register guards the company's things. These ten minutes guard the register.
See the system this guide protects, installed and running in the video from the start.
▶️ Watch Full VideoBack up first (database, uploads and .env), read the release notes, then update by your route — pull the new Docker image and restart, or fetch the new code and run composer install and php artisan migrate on manual installs. Test the login and a few screens afterwards.
For most offices, no. Keep it on the local network or behind the company VPN, served over HTTPS. It holds your complete asset and custody map, and it has almost no legitimate reason to face the public internet.
Yes. Snipe-IT supports two-factor authentication with authenticator apps, and it should be switched on for every admin and superuser account. It also supports SAML single sign-on for larger organisations.