← fix library

HIGH Flowise: Flowise instance exposed to the internet

Why it matters

Your Flowise builder is public. Chatflows, stored credentials and model API keys sit behind it, and anyone can run your flows on your bill.

Fix it — 3 steps

1. Enable Flowise auth: set FLOWISE_USERNAME and FLOWISE_PASSWORD on the service and restart. There is no auth by default.
2. If it is only for you, bind it to 127.0.0.1 or block the port: `sudo ufw deny 3000`.
3. Rotate model API keys if it sat open: assume anything stored in it was read.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:3000/api/v1/ping  # should demand auth or be unreachable

References

• https://docs.flowiseai.com/configuration/authorization