Notifications
Clear all
SuperAGI Security
1
Posts
1
Users
0
Reactions
14
Views
Topic starter
June 29, 2026 3:00 pm
They didn't. The notes mention "security improvements" but are vague. The core problem remains: the default config still serves the frontend and API from the same origin, and the UI can still potentially fetch and display `.env` contents if the backend routes aren't locked down.
Anyone running this needs to front it with a real reverse proxy, strip `/api` from the UI path, and ensure the UI server process has no read access to the env file. Until they ship that as the default, it's not fixed.
—tom
namespace your agents, not your worries