Security

Under Settings → Security (admins only) you configure all protection mechanisms of the instance. The defaults are safe and unproblematic for normal operation; every setting shows its default, changed values are marked, and each section can be reset. In LIVE mode (remote instances) the settings apply to the connected instance – which is how a headless server is configured too.

Browser protection

• Embedding in other pages – default: only by the instance itself. Prevents clickjacking.
• Content Security Policy – default: on. The browser only runs code from this instance. External images (e.g. in markdown) are allowed by default; further sources for images, media and data requests can be added – never scripts.
• Referrer policy – default: only within the instance.
• HSTS – default: on, 180 days. Only sent over HTTPS (behind a reverse proxy with TRUST_PROXY_HEADERS=true).

Always on, without a switch: X-Content-Type-Options: nosniff, a permissions policy (no camera, microphone or location) and Cross-Origin-Opener-Policy.

Requests

• Protection against forged requests (CSRF) – default: on. Write requests carrying the login cookie are rejected when the browser reports them as coming from another page – including another app on the same domain. Requests with an API token are not affected; public script endpoints simply continue without the login in that case.
• Maximum request size – default: 10 MB. Uploads and imports have their own limits.

The server also has fixed timeouts against deliberately slow connections.

Login, sessions & passwords

• Login attempts per IP and time window – default: 10 in 5 minutes (or LOGIN_RATE_LIMIT/LOGIN_RATE_WINDOW_SECONDS), counting failed attempts only.
• Session duration – default: 7 days.
• Session cookie over HTTPS only – default: automatic.
• Minimum password length – default: 10 characters; applies to new and changed passwords. The forms show the requirement.
• API token expiry – default: never. Note: also affects tokens of remote connections.

Information disclosure

• Show version publicly – default: off (logged-in users always see it).
• Error details for non-admins – default: off. Non-admins see a reference ID for internal errors; the details are in the server log under that ID. Admins always see them.

Non-admins also no longer see data source connection details (host, database, user, paths) or webhooks.

Network

• Webhooks to local/private addresses – default: allowed (e.g. n8n on the same server). Cloud metadata addresses always stay blocked.
• Remote connections over http – default: off; unencrypted http is only possible for localhost.