is it safe to run this against a live forum?

tomriggs

thinking about wiring this up to our production flarum but im a bit nervous about handing an AI the keys to the whole api. whats actually stopping it from renaming discussions or deleting posts by accident? do you have to give it write access or is there a safer default? would rather start in a look but dont touch mode if thats possible.

leona_b

by default its read only if you dont give it an api key, it can only see public stuff. once you set FLARUM_API_KEY it can write, but only with whatever permissions that key's user actually has. theres also FLARUM_MODE=read which keeps it read only even when a key is set, thats what i run on our main forum. i also made a separate user with limited perms just for the key so it cant touch anything i dont want it to.

tomriggs

the FLARUM_MODE=read flag is exactly what i was after, thanks. making a scoped user for the key is smart too, hadnt thought of doing it that way.

Karl

leona_b thank you for answer this.

tomriggs By default, I built everything with security in mind. Feel free to challenge everything and anything. Without criticism, there wouldn't be progress. Thank you for checking out MCP for Flarum you two!