AnythingLLM combines document retrieval, chat and agent workflows. The security boundary changes significantly between a desktop or single-user installation and a Docker deployment with multi-user mode. A public scan can identify the product, but it cannot tell which mode is active from a title alone.
Two counts and a strong fingerprint
On 2026-11-07 UTC, page-one count-only ZoomEye probes with sub_type=all returned 7,787 matches for app="AnythingLLM" and 7,435 for title="AnythingLLM". The close counts provide a useful application fingerprint, but they do not establish authentication state. The result can include internet-facing instances, landing pages and deployments behind different access controls.
The product's security documentation warns that a single-user instance without a password or multi-user setup can be reachable by anyone who knows the URL. Multi-user mode adds accounts and roles, but the deployment still needs an external access decision for any audience beyond a trusted internal group.
Treat the API key as instance authority
The developer API uses an API key, and the documentation states that anyone with the key can use it. That is a broad authority claim. Store the key in a secret manager, restrict who can read it, rotate it after suspected exposure and avoid embedding it in a public client. Review the instance's API documentation endpoint as part of the deployment, because the endpoint list reveals the available management and data operations.
The official security policy also treats unrestricted developer API access as part of the product's design rather than a fine-grained tenant control. If the organization needs per-user authorization, it should not assume the shared API key supplies it.
Review the data plane
Document collections and workspaces can contain sensitive material. Confirm who can create workspaces, who can upload documents and whether an agent can use network or code tools. Review the selected model provider and where prompts and retrieved content travel. A local UI does not guarantee a local model.
For owned instances, test unauthenticated access, access with an ordinary user, access with an administrator and API access after key rotation. Check that old documents and cached embeddings do not appear in a new user's workspace. If the instance was intentionally single-user, keep it on a private network with an explicit access layer.
The scanner gives a candidate population. The deployment mode and data visibility determine the risk.