secrets-wtf - secrets.wtf: defensive AI infrastructure exposure

项目说明

<p align="center">
<a href="
<img src="assets/secrets.wtf.png" alt="secrets.wtf - public exposure listings for AI infrastructure" width="1200">
</a>
</p>

secrets.wtf

Public exposure listings for AI infrastructure.

secrets.wtf is a defensi index for publicly reachable AI model API surfaces, starting with Ollama and LM Studio hosts. The project helps operators, researchers, and defenders find exposed local LLM infrastructure, remediation, and track common exposure patterns.

Maintained by Soni ( / @Im), a New York backend systems builder and security researcher focused on AI infrastructure, browser automation, protocol analysis, MCP tooling, Python, Rust, and Go.

Links

| Resource | URL |
| --- | --- |
| Live site | secrets.wtf |
| Ollama listing | secrets.wtf/listings/ollama |
| LM Studio listing | secrets.wtf/listings/lm-studio |
| Research context | OpenDoors |
| Maintainer | Soni |

What This Is

secrets.wtf is a public host in for exposed AI infrastructure. It is built for defensi, responsible cleanup, and security research.

The current focus is:

What This Is Not

This project is not for abuse.

Do not use listed hosts to run workloads, harvest data, test private systems, bypass controls, or interfere with services you do not own. The goal is to document public exposure and help reduce it.

Current Listings

| Listing | Surface | Hosts |
| --- | --- | ---: |
| Ollama exposed API | Ollama model API | 94 |
| LM Studio local server | OpenAI-compatible local server | 87 |

Each listing page supports filtering, pagination, and expandable model obser.

Why It Exists

Local AI tools are often run for testing, de, or internal workflows. When these services bind to public interfaces, they can become reachable from the internet without the operator realizing it.

This project gives that exposure a clear public record:

Add Hosts Or Categories

Pull requests are welcome.

Good contributions include:

For a new category:

1. Add a page under listings/<category>/.
2. Add a JSON in under data/hosts/.
3. Add the category to the homepage.
4. Add the page to sitemap.xml.
5. Keep wording compact, factual, and remediation-focused.

Host Takedown Requests

If you own or operate a listed host and want it removed, open a GitHub issue:

Request host removal

Please include:

Remo are welcome. Do not include credentials, tokens, customer data, private screenshots, or unrelated sensiti in issues or pull requests.

Local De

This is a static GitHub Pages site.

Open:

Project Structure

Related Work

License And Use

Use this project responsibly. The public listings are intended for awareness, remediation, and defensi research.

项目信息

开发语言：HTML

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕secrets.wtf: defensive AI infrastructure exposure index for Ollama and LM Studio hosts, local LLM APIs, model observations, remediation, and takedown requests.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。