SilverBullet authentication and dashboard access need separate checks

2026-11-04来源 dev.toEnglish

SilverBullet authentication and dashboard access need separate checks

SilverBullet is a self-hosted Markdown knowledge system. Its browser client makes notes, team knowledge, and product documentation available from a server, while the data remains in files the operator controls. A public title match can therefore identify a valuable knowledge store without proving that the store is accessible.

Observation

At 08:42 on November 4, 2026 (UTC+8), a count-only ZoomEye SDK query with sub_type=all, page 1, and pagesize 1 returned zero application matches for app="SilverBullet" and 551 title matches for title="SilverBullet". The title count is the lead. It may include documentation, demo spaces, and instances whose application header differs from the title.

Authentication surfaces

SilverBullet's authentication documentation describes SB_USER for a single user and a login page when authentication is enabled. The HTTP API documentation describes authentication routes and a bearer-token path when SB_AUTH_TOKEN is set. It also lists administrative dashboard routes for user management. This creates three questions: who can reach the web application, who can log in, and who can call the administrative API?

A reverse proxy can terminate TLS and provide additional filtering, but it should not be assumed to replace SilverBullet's own authentication. The official Desktop Sync documentation warns that one deployment mode does not support an authentication proxy other than SilverBullet's authentication. Review the exact feature and version in use rather than applying that warning to every route.

The data-plane review should cover the space directory. Markdown files may contain internal links, credentials, customer notes, or private procedures. File permissions for the process, backups, and local sync clients matter as much as the web login page. A browser session that is protected by a password does not protect a readable filesystem copy.

Review controls

Useful checks include:

  • Confirm whether single-user or multi-user authentication is enabled.
  • Inventory bearer tokens and administrative users.
  • Test the admin API from a normal user account.
  • Review file ownership for the space directory and backups.
  • Check reverse-proxy header handling and direct container access.
  • Verify that deleted or disabled users cannot reuse a cached session.

The 551 title matches are not 551 exposed note stores. A public title can be a project page, and a login page may be the intended boundary. Record the response status, authentication mode, and owner for each candidate before drawing a conclusion.

ZoomEye provides a repeatable external observation and a bounded starting list. The internal inventory should pair that observation with authentication mode, dashboard access, API-token ownership, and file permissions. The review is complete only when the public web face and the underlying Markdown store have both been checked.

References

原文：https://www.a8q9.cn/en/article/silverbullet-authentication-and-dashboard-access-need-separate-checks-6054d3.html

相关文章