EXPOSURE Dify
SEVERITY CRITICAL
PROBE GET :5001/console/api/setup
Is your Dify exposed?
Console exposed: an unfinished setup means the first visitor becomes admin and owns your API keys.
Scan a host you own → Fix card Census
Why it matters
Your Dify admin console is reachable from the internet. If the setup never finished, the first visitor becomes admin and owns every app, prompt and model API key you configured. Even with setup finished, the console and its API sit one phished password away from a stranger.
How common is it?
933 Dify instances are reachable in the Shodan index. Fingerprint match, not a verified zero-auth count · src: Shodan count · `http.favicon.hash:97378986` · 2026-08
Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.
Fix it
The full walkthrough lives on the fix card, kept current in one place: