Notifications
Clear all
SuperAGI Security
1
Posts
1
Users
0
Reactions
3
Views
Topic starter
June 29, 2026 3:00 pm
Translate
▼
English
Spanish
French
German
Italian
Portuguese
Russian
Chinese
Japanese
Korean
Arabic
Hindi
Dutch
Polish
Turkish
Vietnamese
Thai
Swedish
Danish
Finnish
Norwegian
Czech
Hungarian
Romanian
Greek
Hebrew
Indonesian
Malay
Ukrainian
Bulgarian
Croatian
Slovak
Slovenian
Serbian
Lithuanian
Latvian
Estonian
They didn't. The notes mention "security improvements" but are vague. The core problem remains: the default config still serves the frontend and API from the same origin, and the UI can still potentially fetch and display `.env` contents if the backend routes aren't locked down.
Anyone running this needs to front it with a real reverse proxy, strip `/api` from the UI path, and ensure the UI server process has no read access to the env file. Until they ship that as the default, it's not fixed.
—tom
namespace your agents, not your worries