From 4d18c26665c76d26ffec8056f0bff0170b817d77 Mon Sep 17 00:00:00 2001 From: Dhravya Date: Mon, 28 Sep 2026 21:17:57 +0000 Subject: [PATCH] docs: avoid promising loopback auth opt-in --- apps/docs/self-hosting/configuration.mdx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/apps/docs/self-hosting/configuration.mdx b/apps/docs/self-hosting/configuration.mdx index fa5186c5..3d61def9 100644 --- a/apps/docs/self-hosting/configuration.mdx +++ b/apps/docs/self-hosting/configuration.mdx @@ -15,10 +15,9 @@ The installer writes API keys to `~/.supermemory/env`, which is loaded on every |---|---|---| | `PORT` (or `SUPERMEMORY_PORT`) | HTTP listen port | `6767` | | `SUPERMEMORY_HOST` | In the next release, controls the listen address; not supported by v0.0.8 | `127.0.0.1` in the next release | -| `SUPERMEMORY_ALLOW_LOOPBACK_AUTH` | In the next release, opt into unauthenticated direct loopback requests; unsafe behind a same-host reverse proxy | unset in the next release | | `SUPERMEMORY_DATA_DIR` | Where the graph engine's data, auth secret, and model cache live | `./.supermemory` | -**The currently published v0.0.8 binds all interfaces and its implicit local authentication is unsafe when exposed to untrusted networks. Do not expose it; restrict access with a firewall or run it on an isolated machine.** The next release will bind loopback and require the generated key for every API request by default, including requests from localhost. Its browser welcome page will no longer reveal the key; enter the key printed at first boot in the Memory tab. When you later expose that release through a reverse proxy, leave loopback auto-auth disabled and protect the endpoint with TLS and access controls. +**The currently published v0.0.8 binds all interfaces and its implicit local authentication is unsafe when exposed to untrusted networks. Do not expose it; restrict access with a firewall or run it on an isolated machine.** The next release will bind loopback and require the generated key for every API request, including requests from localhost. Its browser welcome page will no longer reveal the key; enter the key printed at first boot in the Memory tab. If you later expose that release through a reverse proxy, protect the endpoint with TLS and access controls. ## LLM providers