← fix library

CRITICAL AnythingLLM: AnythingLLM open without authentication

Why it matters

Your AnythingLLM answers anyone on the internet with no login at all. Strangers can chat with your models (you pay for the tokens or the GPU), read every document you uploaded for RAG, and change your settings.

Fix it — 3 steps

1. Enable multi-user mode with a password: Settings → Security → enable Multi-User Mode and set an admin password. Single-user mode has no auth by design.
2. If it only serves this machine, bind it away from the internet: publish on 127.0.0.1 or block the port: `sudo ufw deny 3001`.
3. If you need it shared, front it with an authenticating reverse proxy with TLS. An open AnythingLLM on a domain is a public chatbot funded by you.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:3001/  # should show a login wall or be unreachable, not the app

References

• https://docs.anythingllm.com/installation-selfhosted/security