PSA: Avoid self hosting AppFlowy, they patched a vulnerability in their SaaS but didn't patch the self hosted version.

The AppFlowy Debacle: A Cautionary Tale #

I’ve spent countless hours in the r/selfhosted community, evangelizing the benefits of self-hosting. But, folks, I’m here to tell you that AppFlowy is a hard pass. I know, I know, it’s a great note-taking app, and I love the flexibility of self-hosting. But, let me tell you, this is a case of “be careful what you wish for.” Recently, I stumbled upon a thread in r/selfhosted where someone pointed out that AppFlowy had patched a vulnerability in their SaaS offering, but hadn’t bothered to patch the self-hosted version. I was skeptical at first, but after digging deeper, I realized that this was no joke. I mean, who leaves a known vulnerability open to attack? The community was quick to pounce on AppFlowy, and rightly so.

The Vulnerability: A Recipe for Disaster #

The vulnerability in question is a classic example of a “logic flaw” that can be exploited by an attacker to gain unauthorized access to your AppFlowy instance. I won’t go into the nitty-gritty details, but let’s just say that it’s not exactly rocket science to figure out how to exploit it. And, as one commenter pointed out, “if you’re relying on AppFlowy’s security, you’re already doing it wrong.” Now, I know what you’re thinking: “But, what about the self-hosted version? Isn’t that more secure?” Not necessarily. While self-hosting does give you more control over your instance, it also means that you’re responsible for patching and updating the software yourself. And, let’s be real, most people don’t have the time or expertise to do that. I mean, have you seen the AppFlowy documentation? It’s like trying to read a novel written by a committee of engineers.

The Community Weighs In #

The community is genuinely split on this issue, with some people defending AppFlowy’s decision and others calling for a boycott. One commenter summed it up nicely: “I love AppFlowy, but this is a deal-breaker. If they can’t be bothered to patch the self-hosted version, what’s the point?” I have to agree with that sentiment. If you’re not willing to put in the effort to secure your own instance, then maybe self-hosting isn’t for you.

Alternatives: A Safer Bet #

If you’re looking for a self-hosted note-taking app, there are plenty of alternatives out there that are more secure. For example, you could try using a Docker container for your note-taking app, which would give you more control over the environment and make it easier to patch and update. Or, you could use a cloud provider like Hetzner, which offers more robust security features than AppFlowy.

The Bottom Line #

In the end, it’s up to you to decide whether or not to self-host AppFlowy. But, let me tell you, I wouldn’t recommend it. This is a classic case of “be careful what you wish for,” and I’d hate to see anyone get burned. So, do yourself a favor and avoid AppFlowy altogether. Your notes (and your security) will thank you.

FAQ #

{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "Is AppFlowy's self-hosted version secure?"
    },
    {
      "@type": "Answer",
      "text": "No, AppFlowy's self-hosted version is not secure due to a known vulnerability that has not been patched."
    },
    {
      "@type": "Question",
      "name": "What alternatives are available to self-hosted AppFlowy?"
    },
    {
      "@type": "Answer",
      "text": "There are several alternatives available, including Docker containers and cloud providers like Hetzner."
    },
    {
      "@type": "Question",
      "name": "Can I still use AppFlowy's self-hosted version?"
    },
    {
      "@type": "Answer",
      "text": "Yes, but at your own risk. If you're not willing to put in the effort to secure your instance, you may be leaving yourself open to attack."
    }
  ]
}