[PR #176] [MERGED] docs: add security policy and correct multi-user mode wording #151

New issue

Closed

opened 2026-10-18 21:11:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 21:11:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-terminal/pull/176
Author: @Classic298
Created: 9/17/2026
Status: ✅ Merged
Merged: 9/17/2026
Merged by: @tjbck

Base: main ← Head: docs/security-policy

📝 Commits (3)

be28ec9 docs: add security policy and correct multi-user mode wording
cac86d6 docs: point per-user isolation at Terminals and its enterprise license
6aef6bc docs: link the enterprise license to the docs page

📊 Changes

2 files changed (+63 additions, -5 deletions)

View changed files

📝 README.md (+6 -5)
➕ SECURITY.md (+57 -0)

📄 Description

The README promised that files, commands and terminals are isolated between users in multi-user mode. A single shared container cannot hold that promise: everyone shares one kernel, one process list, one network stack and one temp directory, and provisioning per-user accounts requires elevated privileges inside that container. The wording now says what the mode actually gives you, which is a separate workspace per user so people and their agents do not walk over each other's files, and it points at Terminals for deployments where users have to be protected from each other.

The new SECURITY.md adopts the Open WebUI security policy wherever it is semantically applicable, names this repository as the reporting channel, and writes down what is designed behaviour here: the API key is a full-access credential, X-User-Id is asserted by the caller, the latest image gives its user passwordless sudo, and bare metal runs as your own user. It also states what remains in scope, so that reports crossing out of the instance still get the attention they deserve.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-terminal/pull/176 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 9/17/2026 **Status:** ✅ Merged **Merged:** 9/17/2026 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `main` ← **Head:** `docs/security-policy` --- ### 📝 Commits (3) - [`be28ec9`](https://github.com/open-webui/open-terminal/commit/be28ec914bfd589358d6f0878cb1feccd9a868b3) docs: add security policy and correct multi-user mode wording - [`cac86d6`](https://github.com/open-webui/open-terminal/commit/cac86d64f24f044a9cc24329b8c2513264436698) docs: point per-user isolation at Terminals and its enterprise license - [`6aef6bc`](https://github.com/open-webui/open-terminal/commit/6aef6bc56b3197ccf0a73c8f0219bc320b0bfc04) docs: link the enterprise license to the docs page ### 📊 Changes **2 files changed** (+63 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+6 -5) ➕ `SECURITY.md` (+57 -0) </details> ### 📄 Description The README promised that files, commands and terminals are isolated between users in multi-user mode. A single shared container cannot hold that promise: everyone shares one kernel, one process list, one network stack and one temp directory, and provisioning per-user accounts requires elevated privileges inside that container. The wording now says what the mode actually gives you, which is a separate workspace per user so people and their agents do not walk over each other's files, and it points at Terminals for deployments where users have to be protected from each other. The new SECURITY.md adopts the Open WebUI security policy wherever it is semantically applicable, names this repository as the reporting channel, and writes down what is designed behaviour here: the API key is a full-access credential, X-User-Id is asserted by the caller, the latest image gives its user passwordless sudo, and bare metal runs as your own user. It also states what remains in scope, so that reports crossing out of the instance still get the attention they deserve. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-18 21:11:16 +00:00

closed this issue
added the
pull-request
label

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-webui/open-terminal#151

No description provided.

Rows
Columns