Home
Relevant source files
The following files were used as context for generating this wiki page:- README.md
- frontend/index.html
- frontend/package.json
- frontend/src/components/Features.tsx
- frontend/src/components/Footer.tsx
- frontend/src/components/LocationInfo.tsx
- frontend/src/components/PricingBottomSection.tsx
- frontend/src/components/Solutions.tsx
- frontend/src/index.css
- frontend/src/pages/About.tsx
- frontend/src/pages/Legal.tsx
LLaMa Leaks is a passive AI security awareness project. Its primary goal is to highlight the security risk of accidentally exposing unauthenticated Ollama AI servers to the public internet. The project does not perform any hacking or exploitation; it only observes and reports on publicly accessible endpoints to encourage better security practices among developers and organizations. The main application is a single-page web dashboard built with React and Vite.
The project's mission is educational, aiming to help developers identify and secure their infrastructure before it can be exploited by malicious actors. It provides live examples of exposed servers, explains the risks, and offers concrete solutions for securing them. The site also includes About and Legal pages for further context.
Sources: README.md, frontend/src/pages/About.tsx:47-55, frontend/src/components/Footer.tsx:19-22
Core Feature: Live Evidence Dashboard
The central feature of the homepage is the "Live Evidence" section, which displays data from a randomly selected, publicly exposed Ollama server. This section is designed to provide a real-world example of the security issue the project addresses.
Sources: frontend/src/components/LocationInfo.tsx:210-216
Data Fetching and Display
The LocationInfo component is responsible for fetching and rendering the server data. On component mount, it initiates an asynchronous request to a static JSON file.
This diagram illustrates the data fetching flow within the LocationInfo component.
Server Data Structure
The data for each server is structured according to the ServerData interface. This includes geographic information, server version, and details about the AI models it hosts.
| Field | Type | Description |
|---|---|---|
ip | string | The masked IP address of the server. |
port | number | The port number the Ollama service is running on. |
version | string | The version of the Ollama software. |
city | string | The city where the server is located. |
country | string | The two-letter country code (e.g., 'US'). |
country_name | string | The full country name (e.g., 'United States'). |
region | string | The region or state. |
latitude | string | The geographic latitude. |
longitude | string | The geographic longitude. |
local | ServerModel[] | An array of AI models available on the server. |
running | ServerModel[] | An array of AI models currently running in memory. |
first_seen_online | string | An ISO 8601 timestamp of when the server was first detected. |
age | string | A human-readable string representing how long the server has been seen. |
status | string | The current status of the server (e.g., 'live'). |
The ServerModel is defined as:
name:stringmodel:stringsize:number
Sources: frontend/src/components/LocationInfo.tsx:11-26
Educational Components
The homepage is structured to educate users about the risks of exposed AI servers and how to mitigate them.
Features of an Exposed Server
The "Why Your Ollama Server is a Security Nightmare" section uses a series of cards to sarcastically highlight the security flaws.
| Feature | Description | Badge |
|---|---|---|
| Completely Exposed | The server is accessible to everyone on the internet. | Concerning |
| Visible to All | Anyone can see and query the models, potentially abusing resources. | Obvious |
| Internet Famous | The server is discoverable via internet scans. | Unfortunate |
| Zero Authentication | No API keys or passwords are required for access. | Liberating |
| Easy to Abuse | Malicious actors can use the models for harmful purposes. | Generous |
| 24/7 Availability | The server is always on and serving requests, incurring costs for the owner. | Dedicated |
Sources: frontend/src/components/Features.tsx:28-63
Security Solutions
The Solutions component provides actionable advice for securing an Ollama server, categorized into quick fixes and long-term strategies.
This flowchart shows the recommended steps to secure a server.
Quick Fixes
| Fix | Description |
|---|---|
| Bind to localhost only | Run the service on 127.0.0.1:11434. |
| Use reverse proxy | Place a proxy with authentication in front. |
| Set up firewall rules | Block unnecessary ports. |
| Monitor access logs | Check logs regularly for anomalies. |
Sources: frontend/src/components/Solutions.tsx:30-77
Long-Term Solutions
| Solution | Description |
|---|---|
| API key authentication | Secure endpoints with API keys. |
| Use VPN for remote access | Use secure tunneling for access. |
| Set up rate limiting | Control request frequency. |
| Regular security audits | Stay vigilant with regular scans. |
Sources: frontend/src/components/Solutions.tsx:82-129
Frequently Asked Questions
The PricingBottomSection component addresses common questions about the project's purpose and cost.
| Question | Answer |
|---|---|
| Is this really free? | Yes, it is a passion project with no hidden costs. |
| What's the catch? | There is no catch; the goal is to encourage responsible reporting of exposed keys. |
| Can I donate? | Instead of money, users are asked to spread the word about good security practices. |
| Will you add paid features? | Highly unlikely, as the core mission is to keep the service free and accessible. |
Sources: frontend/src/components/PricingBottomSection.tsx:8-23
Frontend Application Architecture
The frontend is a modern web application built with Vite, React, and TypeScript. It uses TailwindCSS for styling, with a design system defined in index.css, and Shadcn UI for its component library.
Sources: frontend/package.json, frontend/src/index.css, frontend/index.html
Key Dependencies
The project relies on several key libraries for its functionality and user interface.
| Library | Usage |
|---|---|
react / react-dom | Core UI library. |
vite | Build tool and development server. |
tailwindcss | Utility-first CSS framework for styling. |
@radix-ui/* / shadcn | Foundational components for building the UI (e.g., Card, Button). |
lucide-react | Icon library. |
mapbox-gl | Renders the map in the LocationInfo component. |
embla-carousel-react | Powers the responsive carousel in the Features component. |
Sources: frontend/package.json:13-74
Theming and Styling
The application defines a comprehensive set of CSS variables for light and dark themes, ensuring a consistent look and feel. These variables control colors for background, foreground, primary/secondary elements, cards, and more.
/* frontend/src/index.css:7-10 */
:root {
--background: 210 50% 96%;
--foreground: 210 20% 12%;
/* ... more light theme variables */
}
/* frontend/src/index.css:50-54 */
.dark {
--background: 210 13% 9%;
--foreground: 210 40% 98%;
/* ... more dark theme variables */
}
Sources: frontend/src/index.css:6-91