
I made a small tool called xmr-ops for people running their own Monero payment setup.
It checks local config files for common mistakes like exposed wallet-rpc, bad bind settings, loose env/wallet file permissions, webhook issues, reverse proxy mistakes, missing backup signs, and risky Docker settings.
It is local-only and read-only. No telemetry, no RPC probing, no wallet access.
I am looking for feedback from people who actually run this kind of setup. Mostly interested in what assumptions are wrong, what checks are useless, or what obvious footguns I missed.