Minimize /api/config exposure

[vaguirre830]

Hello there! My organization uses LibreChat and we recently underwent a security audit. There was a finding that mentioned https://<Librechat>/api/config was exposed to the public although this appears to be by design. I confirmed that the config file is sanitized with no sensitive information, but is there a method to not expose so much information about the types of logins? Or is there perhaps a way to only show a minimal config file to unauthenticated users?

I found an old, similar discussion from 2024 but I couldn't find any recent info: danny-avila/LibreChat#3104

[vaguirre830]

Anyone have some thoughts on this? Thank you!

[vaguirre830]

Hey @danny-avila , do you have any thoughts on this? Thank you!