langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-25 13:36:01 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[MarketPlace] Privacy concern #11807

New Issue
Closed
opened 2026-02-21 19:04:10 -05:00 by yindo · 4 comments
yindo commented 2026-02-21 19:04:10 -05:00
Owner
Copy Link
Copy Source

Originally created by @DavideDelbianco on GitHub (Mar 19, 2025).

Self Checks

  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

The Marketplace is currently not released or open sourced and marketplace.dify.ai is, essentially, a blackbox that could potentially trace, profile, run analytics on sensitive user data such as, but not limited to:

  • ip address
  • browser agent
  • origin domain

For this reason, the env variable: MARKETPLACE_API_URL should not use the URL directly but be handled through the nginx proxy to remove sensible data

2. Additional context or comments

Reference to this issue in a helm_chart that supports self-deployed installations:
https://github.com/BorisPolonsky/dify-helm/pull/131

3. Can you help us with this feature?

  • I am interested in contributing to this feature.
Originally created by @DavideDelbianco on GitHub (Mar 19, 2025). ### Self Checks - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [x] Please do not modify this template :) and fill in all the required fields. ### 1. Is this request related to a challenge you're experiencing? Tell me about your story. The Marketplace is currently not released or open sourced and _marketplace.dify.ai_ is, essentially, a blackbox that could potentially trace, profile, run analytics on sensitive user data such as, but not limited to: - ip address - browser agent - origin domain For this reason, the env variable: MARKETPLACE_API_URL should not use the URL directly but be handled through the nginx proxy to remove sensible data ### 2. Additional context or comments Reference to this issue in a helm_chart that supports self-deployed installations: https://github.com/BorisPolonsky/dify-helm/pull/131 ### 3. Can you help us with this feature? - [ ] I am interested in contributing to this feature.
yindo closed this issue 2026-02-21 19:04:10 -05:00
yindo commented 2026-02-21 19:04:10 -05:00
Author
Owner
Copy Link
Copy Source

@benjamin-mogensen commented on GitHub (Mar 19, 2025):

Perhaps it should be possible to disable external marketplace all together, or be able to select which specific plugins are allowed to be used. That way we can be in more control of what is accessible to our users and gives us a chance to actually curate and evaluate the plugins.

@benjamin-mogensen commented on GitHub (Mar 19, 2025): Perhaps it should be possible to disable external marketplace all together, or be able to select which specific plugins are allowed to be used. That way we can be in more control of what is accessible to our users and gives us a chance to actually curate and evaluate the plugins.
yindo commented 2026-02-21 19:04:11 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Mar 19, 2025):

https://github.com/langgenius/dify/blob/ac80c04bd34344468b03f9c9e9d68fc7c00a6877/docker/docker-compose.yaml#L425-L426

Perhaps it should be possible to disable external marketplace all together, or be able to select which specific plugins are allowed to be used. That way we can be in more control of what is accessible to our users and gives us a chance to actually curate and evaluate the plugins.

To clarify, we could disable this MARKETPLACE_ENABLED in self-hosted version in case you do not want to install unverified packages. You can install verified packages or create one by using our cli tools.

Regarding the marketplace marketplace.dify.ai.

We will review the package submitted to our marketplace, you can find those packages:

@crazywoola commented on GitHub (Mar 19, 2025): https://github.com/langgenius/dify/blob/ac80c04bd34344468b03f9c9e9d68fc7c00a6877/docker/docker-compose.yaml#L425-L426 > Perhaps it should be possible to disable external marketplace all together, or be able to select which specific plugins are allowed to be used. That way we can be in more control of what is accessible to our users and gives us a chance to actually curate and evaluate the plugins. To clarify, we could disable this `MARKETPLACE_ENABLED` in self-hosted version in case you do not want to install unverified packages. You can install verified packages or create one by using our cli tools. Regarding the marketplace `marketplace.dify.ai`. We will review the package submitted to our marketplace, you can find those packages: - https://github.com/langgenius/dify-official-plugins - https://github.com/langgenius/dify-plugins
yindo commented 2026-02-21 19:04:11 -05:00
Author
Owner
Copy Link
Copy Source

@benjamin-mogensen commented on GitHub (Mar 19, 2025):

Thanks @crazywoola from which version can we disable marketplace? And also, can we host our own marketplace on an internal URL (it seems almost like it from the lines you pasted above)?

@benjamin-mogensen commented on GitHub (Mar 19, 2025): Thanks @crazywoola from which version can we disable marketplace? And also, can we host our own marketplace on an internal URL (it seems almost like it from the lines you pasted above)?
yindo commented 2026-02-21 19:04:11 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Mar 19, 2025):

Thanks @crazywoola from which version can we disable marketplace? And also, can we host our own marketplace on an internal URL (it seems almost like it from the lines you pasted above)?

From v1.0.0, but it has some bugs in this version, I suggest using the latest version v1.1.0 instead.

And also, can we host our own marketplace on an internal URL (it seems almost like it from the lines you pasted above)?

Not yet, if you disabled it in the configuration, then you will be able to uploaded manually for now.

@crazywoola commented on GitHub (Mar 19, 2025): > Thanks [@crazywoola](https://github.com/crazywoola) from which version can we disable marketplace? And also, can we host our own marketplace on an internal URL (it seems almost like it from the lines you pasted above)? From v1.0.0, but it has some bugs in this version, I suggest using the latest version v1.1.0 instead. > And also, can we host our own marketplace on an internal URL (it seems almost like it from the lines you pasted above)? Not yet, if you disabled it in the configuration, then you will be able to uploaded manually for now.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#11807
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?