Default credentials are set via MATRIX_AUTH_USER / MATRIX_AUTH_PASS env vars (or "admin" / "matrix@admin" if unset) — change them before exposing this on a network you don't fully trust.