Helpin
Dark mode
Security checklist

Security checklist

Go through this checklist before a self-hosted installation handles real customers. Each item links a setting to the risk it closes.

Network

  • Only your HTTPS proxy (the built-in Caddy, or your own) is reachable from the internet, on ports 80 and 443.

  • BIND_ADDRESS is 127.0.0.1 (the default), so the app, help center, and storage ports stay on loopback.

  • PostgreSQL, Redis, NATS, Temporal, Agent Runtime, and the storage console are not exposed.

  • /api/internal/ is not routed publicly.

  • A dedicated widget hostname, if you use one, serves only /widget/* and /sdk/*.

  • COMMUNITY_TRUSTED_PROXY_CIDR matches your proxy's exact source address, never 0.0.0.0/0. Built-in HTTPS sets this for you. With your own proxy, check it. This keeps client-IP rate limits honest.

  • Every public URL uses HTTPS, which avoids mixed content and keeps sessions secure.

Accounts and access

  • You signed up first, so you're the server admin, before exposing the server.

  • The signup policy is Invite only or Approved email domains (Settings → Signup & admins).

  • At least two people are server admins, or HELPIN_ADMIN_EMAILS lists a recovery address.

  • Workspace roles follow least privilege. Module access is limited to the teams that need it.

  • Two-factor authentication is enabled for admins.

Secrets

  • community/.env is mode 600 and owned by the operator account (helpin doctor checks this).

  • .env is backed up with your data, in encrypted, off-host storage.

  • Encryption keys are never rotated in .env alone.

  • Secrets are passed to the CLI through files or environment variables, never as arguments.

Chat widget

  • The widget's allowed-origin list contains only your real sites. An empty list blocks everyone.

  • Require server-signed identities is on if your widget identifies logged-in users. Otherwise identities are treated as unverified claims.

  • The identity signing secret lives only on your backend, never in the browser.

Agents

  • Each agent has only the tools and approvals its job needs.

  • External MCP servers use HTTPS on public hosts. AGENT_RUNTIME_MCP_ALLOW_HTTP and AGENT_RUNTIME_MCP_ALLOW_PRIVATE_NETWORKS stay false unless you deliberately need them.

  • Code execution in Ask Agent is enabled only for users you trust to run commands in the shared agent worker.

Operations

  • Nightly backups run, are copied off-host, and a restore has been tested.

  • You're subscribed to Helpin release notes and apply security releases promptly.

  • SENTRY_DSN is either empty or points to a project you control.

Report a vulnerability

Report security issues privately through GitHub's private vulnerability reporting for the Helpin repository, never in public issues or pull requests. Leave customer data, tokens, and passwords out of your report.

Was this article helpful?