ToolJet Security Scanner
Building internal tools with ToolJet? Make sure your data sources, queries, and user permissions are locked down before deployment.
Our automated security scanner analyzes your ToolJet application for vulnerabilities, misconfigurations, and exposed secrets. Get a comprehensive security report in minutes, not days.
Top 4 Security Issues in ToolJet Apps
Unparameterized AI Queries
ToolJet 3.0's AI Query Builder generates SQL from natural language. These queries may not use parameterized inputs, creating injection vectors.
Exposed Data Source Credentials
Database passwords and API keys may be accessible to all workspace members or exposed through misconfigurations.
Admin Panel Without Auth
Self-hosted ToolJet instances may expose the admin interface without proper authentication or IP restrictions.
Overly Permissive Query Access
Users may be able to execute any query against connected data sources, not just the queries their role requires.
Where Security Breaks in ToolJet Apps
Built on Postgres, ToolJet applications share a recognizable fingerprint, which means attackers and automated scanners find them the same way every time. Based on real vulnerability patterns in ToolJet deployments, the breakdown is 0 critical-impact issues, 3 high-impact, and 1 medium-or-lower.
Unparameterized AI Queries
ToolJet 3.0's AI Query Builder generates SQL from natural language. These queries may not use parameterized inputs, creating injection vectors.
Fix: Use parameterized queries, sanitize all user input, and render dynamic content with framework escaping (React JSX, not dangerouslySetInnerHTML).
Exposed Data Source Credentials
Database passwords and API keys may be accessible to all workspace members or exposed through misconfigurations.
Fix: Move all secrets server-side (environment variables, serverless functions). Rotate any keys previously in frontend code. Audit bundles for leftover credentials before each deploy.
Admin Panel Without Auth
Self-hosted ToolJet instances may expose the admin interface without proper authentication or IP restrictions.
Fix: Enforce email verification, minimum password requirements, and rate limiting on auth endpoints. Test auth flows as unauthenticated and cross-user to verify access controls.
Overly Permissive Query Access
Users may be able to execute any query against connected data sources, not just the queries their role requires.
Fix: Scan your deployed application with a security tool that understands this stack. Address the specific findings — generic best practices don't catch platform-specific misconfigurations.
What We Check
Credential Exposure
Scans for database connection strings and API keys accessible in frontend code.
Query Security
Analyzes queries for SQL injection risks from AI-generated code.
Access Controls
Tests user permission groups and query-level access restrictions.
Deployment Config
Checks for exposed admin panels, default credentials, and missing headers.
What You'll Get
Why ToolJet Apps Need Security Scanning
ToolJet is an open-source low-code platform for building internal tools. Its AI Query Builder makes it faster to create data-driven apps, but internal tools often have direct access to production databases.
The biggest risk is that internal tools are treated as trusted by default. A single misconfigured permission can give attackers access to your production database. vas scans for these issues.
How ToolJet Security Scanning Works
Submit Your URL
Enter your ToolJet application URL. Our scanner automatically detects your tech stack and configures the appropriate security checks for ToolJet.
Automated Analysis
We scan for exposed secrets, security headers, authentication issues, database misconfigurations, and ToolJet-specific vulnerabilities. A deep scan typically completes in 20-30 minutes.
Get Actionable Results
Receive a detailed report with prioritized vulnerabilities, severity ratings, and step-by-step remediation guidance with code examples specific to ToolJet.
Common Questions About ToolJet Security
What vulnerabilities are most common in ToolJet apps?
The top finding classes in ToolJet apps: unparameterized ai queries; exposed data source credentials; admin panel without auth.
What does a vas scan of a ToolJet app check?
The scan probes your deployed app for the specific findings above: credential exposure, query security, access controls, deployment config. It actually attempts each vulnerability class (not just header inspection) and reports results with severity + fix for each.
Is running a scan safe for production?
Yes. The scanner uses read-only probes against public endpoints: no data modification, no destructive tests. A deep scan typically finishes in 20-30 minutes and will not impact application availability.
Remediation Playbook for ToolJet
Priority-ordered fixes for the specific findings we see in ToolJet apps. Critical items close data-exposure gaps; high items prevent compromise; medium items reduce attack surface. Applies to apps using Postgres, the dominant ToolJet stack.
1. Unparameterized AI Queries
Why it matters: ToolJet 3.0's AI Query Builder generates SQL from natural language. These queries may not use parameterized inputs, creating injection vectors.
How to close it: Use parameterized queries, sanitize all user input, and render dynamic content with framework escaping (React JSX, not dangerouslySetInnerHTML).
2. Exposed Data Source Credentials
Why it matters: Database passwords and API keys may be accessible to all workspace members or exposed through misconfigurations.
How to close it: Move all secrets server-side (environment variables, serverless functions). Rotate any keys previously in frontend code. Audit bundles for leftover credentials before each deploy.
3. Admin Panel Without Auth
Why it matters: Self-hosted ToolJet instances may expose the admin interface without proper authentication or IP restrictions.
How to close it: Enforce email verification, minimum password requirements, and rate limiting on auth endpoints. Test auth flows as unauthenticated and cross-user to verify access controls.
4. Overly Permissive Query Access
Why it matters: Users may be able to execute any query against connected data sources, not just the queries their role requires.
How to close it: Scan your deployed application with a security tool that understands this stack. Address the specific findings — generic best practices don't catch platform-specific misconfigurations.
Verify the fixes stuck
Run a vas scan after applying each fix to confirm the gap is actually closed. "I applied the fix" is not evidence. The fix may have been partial, reverted, or not deployed. Re-scanning gives you proof, and a record for compliance if you ever need it.
Secure Your ToolJet App
Don't let vulnerabilities compromise your hard work. Security issues in ToolJet applications can lead to data breaches, unauthorized access, and damaged user trust. The average data breach costs startups between $120,000 and $1.24 million.
Run your first scan free, in minutes. Scan before you launch and deploy with confidence knowing your application meets security best practices.
More on ToolJet Security
Every angle of ToolJet security, from the specific findings we detect to step-by-step fixes.
ToolJet Security Risks
Specific risks we find in ToolJet apps, with real-world examples.
ToolJet Security Issues
Issues grouped by severity with detection and fix steps.
ToolJet Security Checklist
Pre-launch checklist covering every finding class for ToolJet.
How to Secure ToolJet Apps
Step-by-step hardening guide for ToolJet deployments.