Coze Studio stores API keys, workflow configurations, and potentially sensitive business logic. When deploying to public networks, additional security hardening is required to protect against unauthorized access and potential vulnerabilities.
Coze Studio is designed primarily for localhost deployment (http://localhost:8888/). For public network deployments, assess and mitigate these security risks:
¶ 1) Account Registration and Access Control
- Any user can register and use the service if registration is left open
- Unauthorized access to your AI agents and workflows
- Disable registration function after creating admin account
- Enable email whitelist to restrict who can register
- Use strong passwords for all accounts
- Implement SSO if available for enterprise deployments
- Workflow code nodes can execute Python code
- Potentially unsafe code execution without proper isolation
- Enable sandbox environment for workflow code nodes (default)
- Restrict code execution to trusted users only
- Audit workflow code before deployment to production
- Limit Python package access in sandbox configuration
- Improper network configuration may allow SSRF attacks
- Attackers could access internal network resources
- Configure network restrictions according to business requirements
- Restrict to intranet access where possible
- Use firewall rules to limit outbound connections
- Block access to internal IP ranges from workflow HTTP nodes
- By default, server listens on
localhost only
- Public deployment may expose service on
0.0.0.0
- Only listen on
0.0.0.0 when necessary
- Use reverse proxy (Nginx, Caddy, Traefik) for external access
- Add authentication at reverse proxy level
- Implement rate limiting to prevent abuse
- Use TLS/HTTPS for all public connections
- Third-party plugin credentials may be exposed
- OAuth tokens require secure storage
- Store plugin credentials in secure secret management
- Use environment variables for sensitive configuration
- Rotate OAuth tokens periodically
- Limit plugin permissions to minimum required scope
- Image upload requires public network access
- Potential for malicious file uploads
- Configure public domain/IP properly for upload component
- Validate file types and scan uploads
- Use cloud storage with proper access controls
- Implement upload size limits
- Run as non-root - Ensure containers run as non-root user
- Read-only filesystem - Use read-only root where applicable
- Drop capabilities - Remove unnecessary Linux capabilities
- Resource limits - Set CPU and memory limits
- Network isolation - Use Docker networks to isolate services
- Coze Studio Quickstart: https://github.com/coze-dev/coze-studio/wiki/2.-Quickstart#security-risks-in-public-networks
- Coze Studio Repository: https://github.com/coze-dev/coze-studio
- Report Security Issues: Contact ByteDance security team
Any questions?
Feel free to contact us. Find all contact information on our contact page.