← fix library

HIGH LiteLLM: LiteLLM proxy reachable without a master key

Why it matters

An open LiteLLM proxy exposes your model catalog and often lets strangers burn your upstream API budget through /v1/chat/completions.

Fix it — 3 steps

  1. Set `general_settings.master_key` (or `--api_key`) and require virtual keys for callers.
  2. Bind the proxy to localhost or a private network; front it with an authenticating reverse proxy if remote access is required.
  3. Block the port at the firewall: `sudo ufw deny 4000`.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:4000/v1/models  # should return 401/403, not a model list

References

Not sure if your stack is exposed?

Run the free check — 30 seconds, safe read-only probes.

Scan your stack