← fix library

MEDIUM Langfuse: Langfuse reachable from the internet

Why it matters

Your LLM observability stack is publicly reachable — Langfuse stores prompts, completions, and traces that can contain customer data and secrets. If the sign-up page is open, anyone can create an account and start reading them.

Fix it — 3 steps

1. Disable public sign-up: set NEXT_PUBLIC_SIGN_UP_DISABLED=true (Langfuse v3) and restart; create accounts by invitation only.
2. Don't expose it on a public IP: bind to 127.0.0.1 or your VPN interface and put an authenticating reverse proxy or VPN in front.
3. Block the port at the firewall: `sudo ufw deny 3000`.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:3000/auth/sign-up  # should time out or 404/redirect to login, not render a sign-up form

References

• https://langfuse.com/self-hosting/configuration