[PR #1428] [CLOSED] docs: correct the security pages' defaults and the scope of the agent, encryption and audit controls against the code #1393

New issue

Closed

opened 2026-10-18 14:19:21 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 14:19:21 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/docs/pull/1428
Author: @silentoplayz
Created: 9/18/2026
Status: ❌ Closed

Base: main ← Head: docs/security-pages

📝 Commits (1)

1a93f9b docs: correct the security pages' defaults and the scope of the agent, encryption and audit controls against the code

📊 Changes

8 files changed (+27 additions, -21 deletions)

View changed files

📝 docs/getting-started/advanced-topics/hardening.md (+1 -1)
📝 docs/security/accepted-risks/agentic-application-risks.mdx (+3 -3)
📝 docs/security/accepted-risks/auth-timing.mdx (+1 -1)
📝 docs/security/accepted-risks/llm-output-unpredictability.mdx (+2 -2)
📝 docs/security/accepted-risks/oauth-token-exchange-client-trust.mdx (+1 -1)
📝 docs/security/chat-data-privacy-and-encryption.mdx (+14 -8)
📝 docs/security/security-policy.mdx (+3 -3)
📝 docs/security/supply-chain-security/index.mdx (+2 -2)

📄 Description

Summary

I checked the factual claims on the security pages against the code. The policy positions are unchanged.

Chat data privacy: chat file upload and community sharing are on by default, so "keep off" became "turn off". USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED is enforced by the web UI for non-admin users (the toggle is hidden and every new chat is temporary) while the API still saves chats, so it is described as a UI control, not a server-side guarantee. The encryption section now says what is stored in plain form (chat JSON, uploads, vector chunks) and what WEBUI_SECRET_KEY protects. Audit logging defaults and the admin chat access exceptions are stated.
Security policy: rule 10 gains ENABLE_PLUGINS=false from the mirrored SECURITY.md, the revocation note says what Redis does and does not revoke, and the process list matches SECURITY.md (SAST and SCA planned) and .github/dependabot.yml (Dependabot now). The hardening page's revocation sentence no longer lists account deactivation, which does not revoke tokens.
Agentic and LLM output pages: agents also act through the code interpreter, web search, image generation and tool servers. workspace.tools governs authoring, while tool use is governed by the tool's access control. The privilege sentence is scoped to Open WebUI's APIs, and code execution is Pyodide in the browser by default.
Supply chain: "reproducible" became "can be checked against", and the dependency mechanism is named.
Auth timing: the argon2 caveat and the sign-in rate limiter. OAuth token exchange: no account creation and the optional rate limit.

None.

Checklist

I have reviewed the relevant documentation and matched the existing style.
This PR meets Open WebUI's contribution standards: it is accurate, relevant to users, narrowly scoped, maintainable, and not promotional content, advertising, lead generation, SEO placement, or a request to list a product, service, provider, integration, gateway, tool, or company primarily for visibility.
I understand that PRs that do not meet these standards may be closed without review and will not be merged. Repeated, low-quality, off-topic, promotional, or intentionally misleading submissions may result in the contributor being blocked from future participation in Open WebUI repositories.

Notes for reviewers

Sources on dev: config.py (permission defaults, ENABLE_COMMUNITY_SHARING, CODE_EXECUTION_ENGINE, ENABLE_WEB_SEARCH_CONFIRMATION), src/lib/components/chat/Chat.svelte (temporary_enforced), models/chats.py, storage/provider.py, env.py (WEBUI_SECRET_KEY uses, AUDIT_*, ENABLE_PLUGINS, PASSWORD_HASH_ALGORITHM), docs/SECURITY.md, .github/dependabot.yml and the workflows directory, models/auths.py (the placeholder hash), routers/auths.py (rate limiters, token exchange), utils/auth.py (revocation callers), and utils/middleware.py (tool_approval_mode). The branch is rebased on main, which has since replaced the SQLCipher recommendation.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/docs/pull/1428 **Author:** [@silentoplayz](https://github.com/silentoplayz) **Created:** 9/18/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `docs/security-pages` --- ### 📝 Commits (1) - [`1a93f9b`](https://github.com/open-webui/docs/commit/1a93f9bf2117866a0de82b472e3b514b44361d60) docs: correct the security pages' defaults and the scope of the agent, encryption and audit controls against the code ### 📊 Changes **8 files changed** (+27 additions, -21 deletions) <details> <summary>View changed files</summary> 📝 `docs/getting-started/advanced-topics/hardening.md` (+1 -1) 📝 `docs/security/accepted-risks/agentic-application-risks.mdx` (+3 -3) 📝 `docs/security/accepted-risks/auth-timing.mdx` (+1 -1) 📝 `docs/security/accepted-risks/llm-output-unpredictability.mdx` (+2 -2) 📝 `docs/security/accepted-risks/oauth-token-exchange-client-trust.mdx` (+1 -1) 📝 `docs/security/chat-data-privacy-and-encryption.mdx` (+14 -8) 📝 `docs/security/security-policy.mdx` (+3 -3) 📝 `docs/security/supply-chain-security/index.mdx` (+2 -2) </details> ### 📄 Description ## Summary I checked the factual claims on the security pages against the code. The policy positions are unchanged. - Chat data privacy: chat file upload and community sharing are on by default, so "keep off" became "turn off". `USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED` is enforced by the web UI for non-admin users (the toggle is hidden and every new chat is temporary) while the API still saves chats, so it is described as a UI control, not a server-side guarantee. The encryption section now says what is stored in plain form (chat JSON, uploads, vector chunks) and what `WEBUI_SECRET_KEY` protects. Audit logging defaults and the admin chat access exceptions are stated. - Security policy: rule 10 gains `ENABLE_PLUGINS=false` from the mirrored SECURITY.md, the revocation note says what Redis does and does not revoke, and the process list matches SECURITY.md (SAST and SCA planned) and `.github/dependabot.yml` (Dependabot now). The hardening page's revocation sentence no longer lists account deactivation, which does not revoke tokens. - Agentic and LLM output pages: agents also act through the code interpreter, web search, image generation and tool servers. `workspace.tools` governs authoring, while tool use is governed by the tool's access control. The privilege sentence is scoped to Open WebUI's APIs, and code execution is Pyodide in the browser by default. - Supply chain: "reproducible" became "can be checked against", and the dependency mechanism is named. - Auth timing: the argon2 caveat and the sign-in rate limiter. OAuth token exchange: no account creation and the optional rate limit. ## Related issue or discussion None. ## Checklist - [x] I have reviewed the relevant documentation and matched the existing style. - [x] This PR meets Open WebUI's contribution standards: it is accurate, relevant to users, narrowly scoped, maintainable, and not promotional content, advertising, lead generation, SEO placement, or a request to list a product, service, provider, integration, gateway, tool, or company primarily for visibility. - [x] I understand that PRs that do not meet these standards may be closed without review and will not be merged. Repeated, low-quality, off-topic, promotional, or intentionally misleading submissions may result in the contributor being blocked from future participation in Open WebUI repositories. ## Notes for reviewers Sources on `dev`: `config.py` (permission defaults, `ENABLE_COMMUNITY_SHARING`, `CODE_EXECUTION_ENGINE`, `ENABLE_WEB_SEARCH_CONFIRMATION`), `src/lib/components/chat/Chat.svelte` (`temporary_enforced`), `models/chats.py`, `storage/provider.py`, `env.py` (`WEBUI_SECRET_KEY` uses, `AUDIT_*`, `ENABLE_PLUGINS`, `PASSWORD_HASH_ALGORITHM`), `docs/SECURITY.md`, `.github/dependabot.yml` and the workflows directory, `models/auths.py` (the placeholder hash), `routers/auths.py` (rate limiters, token exchange), `utils/auth.py` (revocation callers), and `utils/middleware.py` (`tool_approval_mode`). The branch is rebased on `main`, which has since replaced the SQLCipher recommendation. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-18 14:19:21 +00:00