Security

Starting with v0.104.0, some features in Trilium are intentionally disabled in order to reduce the attack surface:

• Backend scripts, which can run processes on the server, access the file system or bypass security measures.
• SQL Console, which can be used to exfiltrate important data such as the document secret or cause irreparable damage to the database.
• Network Access for the Desktop Installation.

To activate any of them, there are three variants:

• For the desktop app, go to Options → Security and toggle the desired option.
  • This will prompt a system dialog confirming the change. Note that scripts could potentially call this confirmation dialog as well, make sure to accept it only if enabling any of these features is required.
  • The settings page will be available for the server-side as well, but the options need to be manually toggled using the other mechanisms described here.
  • This works by setting a separate configuration file in the Data directory.
• In config.ini, set the corresponding option under the Security group.
• Or use environment variables (e.g. TRILIUM_SECURITY_BACKEND_SCRIPTING_ENABLED=true).