siyuan

Least-privilege permissions

• Grant AI agents read-only access by default; restrict write permissions to specific note collections only when necessary
• Use workspace-level access controls to isolate sensitive knowledge bases from general-purpose agents
• Implement role-based boundaries: separate agents for different tasks (e.g., summarization vs. content editing) with corresponding permission scopes
• Regularly audit and revoke unused API tokens or agent credentials

Network isolation

• Run SiYuan behind a reverse proxy (nginx/Caddy) with authentication enabled; never expose the instance directly to the internet
• Restrict agent API endpoints to localhost or internal VPN only; disable external agent integrations unless explicitly needed
• Use firewall rules to limit inbound connections to trusted IPs or networks
• Disable or remove unnecessary plugins and integrations that could widen the attack surface

Monitoring

• Enable and centralize logging for agent operations, API access, and content modifications; store logs outside the SiYuan instance
• Set up alerts for suspicious patterns: bulk exports, unusual access times, or agents querying sensitive collections
• Periodically review agent execution logs and audit trails to detect unauthorized data access
• Monitor system resource usage to identify potential data exfiltration attempts (unusual network/disk I/O)

Red flags to watch for

• Agents making requests outside their declared scope or to unexpected data collections
• Prompts requesting agents to "ignore instructions" or "export all notes" — indicator of injection attempts
• Unpatched or outdated dependencies; missing security advisories for installed plugins
• Agents with overly broad permissions ("access all workspaces") or unchanged default credentials on the deployment