I'm concerned that persistent passwords are not secure by default for Vmix calls.

This could be easily solved with a checkbox on the call setup page to enable a "call accept" process on the call manager page. The host would accept the inbound call, which then commences the master video feed afterward.

Understandably, some people would prefer the convenience of persistent passwords. Though as-is, someone can connect to the call days/weeks later and the master video feed will be sent to the third party if the vMix application happens to be open (regardless if it's streaming or not).

Until there's a feature such as that, are there any other safeguards we can implement for our team besides going to each input-setting page and resetting passwords manually (which is still exposed to URL guessing exploits)?