← fix library

HIGH vLLM: vLLM API open to the internet

Why it matters

Your model-serving API answers anyone: strangers can list your models and run unlimited inference on your GPU — you pay the compute bill, and they can read anything the model was prompted with through your app.

Fix it — 3 steps

1. Restart vLLM with an API key: add `--api-key YOUR_LONG_RANDOM_KEY` and require it from clients (Authorization: Bearer ...).
2. Better: bind to 127.0.0.1 (`--host 127.0.0.1`) and front it with an authenticating reverse proxy or keep it on a private network.
3. Block the port at the firewall: `sudo ufw deny 8000`.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:8000/v1/models  # should return 401/403 or time out, not a model list

References

• https://docs.vllm.ai/en/latest/serving/security.html