About

unauth.dev is built and run by one person, a security engineer based in Spain. No company, no funding, no team page with stock photos. Just someone who got tired of watching security tools say the least useful thing possible.

Here is the story. Earlier this year I put a server on the internet with Ollama, n8n, and Langfuse running with no authentication, on purpose, to see what would happen. Bots found it within the hour. Not days. Within the hour. They were already requesting /vendor/auth.json and other credential paths, wearing fake bot user agents, before the box had existed long enough for me to finish a coffee.

Then I pointed the existing tools at that same box to see what a founder would actually experience. Shodan said ports were open. A hosted scanner returned the same generic paragraph for an unauthenticated model server as for SSH, with a Wikipedia link as the advice. A popular open source scanner screamed CRITICAL about a vulnerability the box was already patched against. Everything detected. Nothing explained.

Meanwhile, about 175,000 Ollama servers sit on the public internet right now, most of them by accident, most of them owned by people who would fix the problem in fifteen minutes if anyone bothered to explain it in plain language.

So this site is the tool I wanted to exist. It checks your server for the AI services attackers find first, grades what it finds, and for every finding gives you the actual fix, in steps, with a command to verify you are done. The scan is free and always will be for single checks. Continuous monitoring is what will eventually pay the server bills.

The bot watch page is the honeypot, still running, still getting probed. The numbers on it are real and live.

I write the blog myself. If something on this site is wrong, I want to know about it.