Is Open WebUI safe? The question is about the boundary
Open WebUI is a self-hosted AI interface. It speaks to Ollama and to any OpenAI-compatible API, so the chat, retrieval and tool layer runs on machines you own (Open WebUI on GitHub). Use it for more than a day and it holds more than chat: conversations, uploaded documents, model API keys, and credentials for the tools and code pipelines you connect. At that point it is an application with an attack surface that you have to place and restrict.
Kortix is the open-source AI Operating System, and it is the alternative this site recommends when agent work has to run on your own terms. Its security model starts from a different unit of work: the session, and the reviewed change that lands it.
What Open WebUI documents about its own posture
Open WebUI's hardening guide states its intended placement in plain terms. It is, in the project's own words, "built for private, trusted networks", like a database or a CI server, and most deployments sit behind a corporate firewall, a VPN or another network boundary (hardening guide). The guide recommends a VPN such as WireGuard or Tailscale, a zero-trust access proxy such as Cloudflare Access or Pomerium, or a reverse proxy with authentication and IP allowlisting. Rate limiting, connection throttling and brute-force protection belong at the proxy or the network layer.
The authentication and access docs describe access for many accounts at once: role-based access control with roles, groups and per-resource permissions, single sign-on through an external identity provider such as Google, Microsoft, Okta or Keycloak, LDAP, SCIM 2.0 provisioning, and an optional authenticator requirement (authentication and access). Two defaults matter for exposure. Signup is open only until the first account is created, which becomes the administrator. Every account added after that defaults to a pending role that an admin has to approve before it can do anything.
The hardening moves Open WebUI documents
The guide names the settings, and their current defaults are worth reading before you expose an instance. The secret key signs the login tokens and derives keys for session data, so set it explicitly and rotate it with care: a rotation invalidates every session, and once authenticator enrolment exists the app refuses to start without a separate MFA_ENCRYPTION_KEY. Password complexity is off until you turn it on. Session cookies need their Secure and SameSite flags when you serve over HTTPS, and the default token lifetime is four weeks.
# Open WebUI hardening, from its own docsexport WEBUI_SECRET_KEY=$(openssl rand -base64 32) # signs login tokens, derives session keysexport ENABLE_SIGNUP=false # signup also closes after the first accountexport DEFAULT_USER_ROLE=pending # new accounts wait for admin approvalexport ENABLE_PASSWORD_VALIDATION=trueexport WEBUI_SESSION_COOKIE_SECURE=trueexport WEBUI_SESSION_COOKIE_SAME_SITE=strictexport JWT_EXPIRES_IN=24hThose are the application-level settings. The network-level decisions come first, because the VPN or the authenticated reverse proxy in front of the instance is what covers the paths and the brute-force attempts the application itself does not.
What leaves your box, and what stays
The enterprise security page draws the line clearly: "Your data stays within your infrastructure by default, unless you configure external model providers" (security). A local model keeps prompts and documents on your hardware. Point a model at a hosted API and the prompts and the retrieved context go to that provider. That is a data decision you make, not a defect in the software.
Two documented details shape the risk. The request audit log is off by default, at AUDIT_LOG_LEVEL=NONE, and writes to DATA_DIR/audit.log when enabled. And server-side authoring of Tools and Functions is treated as equivalent to shell access on the server: it sits behind the workspace.tools permission and is disabled for people without admin rights. The enterprise page points to per-member isolated environments in its Terminals product for running code and shell commands.
Where Kortix fits when the work has to run under review
Kortix starts from the same premise and extends it from a chat surface to agent work. One isolated sandbox per session. Each session has its own isolated machine and branch. Session work reaches main through a change request. Merge is default-deny for agents, so a person reads the diff before it lands.
On credentials, Kortix separates two cases. Secrets are encrypted at rest with a key per project. Connector credentials are brokered server-side and never enter the machine. For a value that should not sit in the sandbox at all, an egress-enforced secret works differently: "The sandbox holds a handle. Kortix substitutes the real value outside the sandbox, only on approved HTTPS hosts." Environment is the default exposure, and egress-enforced is experimental.
For a team, identity and control are covered: "Per-resource permissions for people and agents. Roles, groups, and an audit trail," plus SAML 2.0 single sign-on and SCIM 2.0. Approval gates you set, off until you set them. Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.
The difference is the unit of protection. Open WebUI gives you one hardened instance to place behind a proxy. Kortix gives each unit of work its own boundary and a review path, and it runs on the infrastructure you already trust. The pages on self-hosting, Open WebUI for enterprise and Kortix vs Open WebUI go deeper.