chatbot-ui

工具介绍

AI聊天任何模型.

• #1910

  AI Agent 中文

  更新于 2026年9月5日
• #2041

  /api/chat/custom has no authentication and reads any user's custom-model API key via the service-role client

  更新于 2026年9月2日
• #2040

  delete_storage_object RPC is SECURITY DEFINER and executable by anon — any storage object can be deleted without auth

  更新于 2026年9月2日
• #2039

  Free OpenAI-Compatible Demo Endpoint with Built-In Monetization via ChatADy

  更新于 2026年8月26日
• #2029

  Need perfect AI model For 8 GB VRAM

  更新于 2026年6月26日
• #2028

  Cross-user private file-content disclosure via unvalidated fileIds in the retrieval API (Supabase RLS bypass)

  更新于 2026年6月12日
• #2025

  🎉 Your project is featured in awesome-ai-chat-apps

  更新于 2026年5月24日
• #2022

  Security: Insecure Direct Object Reference（IDOR）

  更新于 2026年4月20日
• #2017

  Security: Missing authentication on custom model endpoint - cross-tenant API key usage (CWE-306)

  更新于 2026年4月4日
• #2016

  Qodo AntiSlop scan found 35 issues across 10 recent PRs

  更新于 2026年4月4日

核心特点

• •Security issues
• •Limited storage
• •Limits multi-modal use cases
• •project_url (line 53): http://supabase_kong_chatbotui:8000 (default) can remain unchanged if you don't change your project_id in the config.toml file
• •service_role_key (line 54): You got this value from running supabase status
• •Project Ref: Found in "General settings" as "Reference ID"
• •Project ID: Found in the URL of your project dashboard (Ex: https://supabase.com/dashboard/project/<YOUR_PROJECT_ID>/settings/general)
• •Project URL: Found in "API Settings" as "Project URL"
• •Anon key: Found in "Project API keys" as "anon public"
• •Service role key: Found in "Project API keys" as "service_role" (Reminder: Treat this like a password!)