Khoj's 19 application matches point to a document assistant that needs identity review

Khoj is a self-hostable assistant that can search the web and answer questions over documents. Its setup documentation covers an admin account, application secret, model-provider keys and document sources. It also documents an anonymous mode and an authentication mode that requires additional configuration. That makes identity a deployment setting, not a property of the product name.

A count-only ZoomEye query on 2026-11-05 returned 19 matches for app="Khoj" and 185 for title="Khoj" with sub_type=all, page 1 and page size 1. Nineteen is a small application sample, while the title count is broad enough to include documentation and unrelated pages. The app count is the more defensible estimate of running instances, but it remains a fingerprint observation rather than proof that a document store is exposed.

Authentication changes the product's meaning

The official authentication page says to remove --anonymous-mode to enable authentication and requires an email or identity configuration for multi-user use. That description matters because an anonymous Khoj instance and a multi-user Khoj instance present very different data and action surfaces. A public search interface may still reveal indexed documents or conversation history, while a signed-in user may be able to connect sources and change model settings.

Review the startup command and environment variables, not only the web page. Confirm the effective admin user, invitation path, session secret and email provider. A session secret generated for a test environment should not be reused in production. The admin password should be unique and stored outside the application repository.

Inventory the connections, not just the chat page

Khoj can read documents from local and external sources, and its setup documentation lists model-provider API keys. A connector credential may grant access to far more content than the chat user expects. Map each source, owner, scope and last successful sync. Remove abandoned connectors and rotate tokens that were placed in environment files or container logs.

For a public instance, test the sign-in boundary without attempting to access private data. Request the root page, API routes and document endpoints from outside the intended network. Confirm that anonymous access is a deliberate choice and that a private deployment rejects unauthenticated indexing jobs or document downloads. A login redirect on the home page does not prove that every API route is protected.

Handle the small sample honestly

Nineteen observations are enough to prioritize validation, not enough to characterize the entire Khoj population. The title count should be used to find related pages for review, not multiplied or combined with the app count. We did not query or inspect individual assets, so this article cannot say whether any instance exposes documents, credentials or model keys.

For owned deployments, compare the observed hostname with the service inventory and the expected public route. Record the Khoj version, authentication mode, enabled connectors and model endpoints. Test account removal and session invalidation after a user leaves the organization.

Detection and response

Monitor login failures, source additions, document imports, model-endpoint changes and anonymous-mode configuration. Alert when an instance moves from private to public exposure or when a connector begins reading an unexpected path. Keep application logs separate from document content where possible.

If a document assistant is exposed, preserve the startup configuration, user list, connector metadata, sync logs and model provider usage. Rotate provider and document-source credentials, revoke sessions, remove unauthorized connectors and identify which documents were synchronized. Rebuild the index only after confirming that the source permissions are correct.

The small application count gives a useful target list. The security question is whether the assistant enforces identity before it searches documents, changes connectors or calls a model with sensitive context.

References

• Khoj authentication
• Khoj self-hosting setup
• Khoj project repository
• ZoomEye app="Khoj" count observation