Dify SECRET_KEY management and rotation risks
Generating and storing Dify's SECRET_KEY, what it signs and encrypts, and why rotating it logs everyone out and breaks OAuth plugin credentials, so rotation needs a planned window.
Dify security hardening
Specific security controls in a self-hosted Dify, from secrets and outbound request filtering to code sandboxes, plugin trust, sign-up policy and API exposure.
Dify workspace encryption keys in Azure Key Vault
Keeping per-workspace credential encryption keys in Azure Key Vault instead of storage: authentication with managed identity, automatic key rotation, and why the choice must be made before the first workspace exists.
Dify SSRF proxy configuration and allowlisting
How the Squid SSRF proxy blocks private networks for HTTP nodes, tools and external knowledge calls, and how to allow specific internal hosts or domains without opening the whole network.
Dify code execution sandbox security
Securing the sandbox that runs Code and Template nodes: replacing the default sandbox API key, network egress through the proxy, timeouts and output limits, and who may author code nodes.
Dify plugin signature verification and private plugins
Keeping signature enforcement on while installing internal plugins: generating a key pair, signing .difypkg files, giving the plugin daemon trusted public keys, and restricting install sources.
Dify sign-up, login and invitation policy
Locking a Community instance to invited users: ALLOW_REGISTER, workspace auto-creation, email code login, social OAuth buttons and account email changes, with mail delivery as a dependency.
Dify API key and MCP server URL exposure
Protecting the credentials that open Dify apps to the outside: service API keys, published MCP server URLs that embed credentials, web app tokens in embed code, and regeneration after exposure.
Dify CORS and public URL configuration
Replacing wildcard CORS defaults for the web and console APIs with explicit origins, and aligning console, API, app and file URLs so tokens and links are not issued for the wrong host.
Dify TLS for Redis, PostgreSQL and internal services
Encrypting connections from Dify to its data stores: Redis TLS and certificate verification levels, the plugin daemon's PostgreSQL sslmode, and sandbox connection verification.
Dify security review and penetration test scope
What a security assessment of a self-hosted Dify should cover: exposed endpoints, SSRF and sandbox escape paths, plugin supply chain, prompt injection through tools and knowledge, and secrets in env files.
