It looks like this is written in Javascript with C backend components. I would never trust giving root to a web service written in C.

If anyone deploys this, make sure to bind only to localhost, and use an ssh tunnel to access it remotely, otherwise you're opening a massive attack surface.