Team Wiki Security Testing

Outline Security Testing: Default Credentials, API Token, Database, and .env SECRET_KEY

📅 July 3, 2026 ⏱ 11 min read 🏷 Outline, Team Wiki Security, SECRET_KEY, AWS S3 Credentials, Slack OAuth, PostgreSQL, Document Enumeration

Outline is a widely deployed open-source team wiki and knowledge base platform (Notion alternative) used by engineering teams to store documentation, runbooks, architecture diagrams, and internal processes — it typically contains highly sensitive internal information. Key assessment areas: the .env file stores SECRET_KEY (used for session token signing), AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY for S3 document storage, SLACK_CLIENT_SECRET for OAuth authentication, and DATABASE_URL with the PostgreSQL password; Outline's REST API allows enumerating all documents and users with a valid API token; and Outline's reliance on external SSO (Slack, Google) means OAuth credential compromise can provide access to all wiki content. This guide covers systematic Outline security assessment.

Authentication and API Token Testing
REST API Document and User Enumeration
env Credential Extraction: SECRET_KEY, S3, OAuth, Database
Outline Security Hardening

Authentication and API Token Testing

# Outline — authentication and API token testing
OUTLINE_URL="https://wiki.example.com"

# Outline uses SSO (Slack/Google OAuth) — no traditional username/password
# API tokens are generated in user settings (Settings > API Tokens)
API_TOKEN="ol_api_your_token_here"

# Verify token and get current user info
curl -s -X POST "${OUTLINE_URL}/api/auth.info" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Content-Type: application/json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if d.get('ok'):
    u = d.get('data',{}).get('user',{})
    team = d.get('data',{}).get('team',{})
    print(f'Authenticated as: {u.get(\"name\")} ({u.get(\"email\")})')
    print(f'Role: {u.get(\"role\")}')
    print(f'Team: {team.get(\"name\")} ({team.get(\"subdomain\")})')
else:
    print(f'Auth failed: {d}')
" 2>/dev/null

# Check if public API is accessible
curl -s "${OUTLINE_URL}/api/auth.config" \
  -H "Content-Type: application/json" \
  -d '{}' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if d.get('ok'):
    providers = d.get('data',{}).get('providers',[])
    print(f'Auth providers: {[p.get(\"id\") for p in providers]}')
" 2>/dev/null

REST API Document and User Enumeration

# Outline REST API — document and user enumeration
OUTLINE_URL="https://wiki.example.com"
API_TOKEN="ol_api_your_token_here"

# List all collections — top-level organizational structure
curl -s -X POST "${OUTLINE_URL}/api/collections.list" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"limit":100}' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if d.get('ok'):
    cols = d.get('data',[])
    print(f'Collections: {len(cols)}')
    for c in cols:
        print(f'  [{c.get(\"id\")}] {c.get(\"name\")} private={c.get(\"private\")} docs={c.get(\"documentsCount\")}')
" 2>/dev/null

# List all documents — full wiki content
curl -s -X POST "${OUTLINE_URL}/api/documents.list" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"limit":100,"sort":"updatedAt","direction":"DESC"}' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if d.get('ok'):
    docs = d.get('data',[])
    print(f'Documents: {len(docs)}')
    for doc in docs[:10]:
        print(f'  [{doc.get(\"id\")}] {doc.get(\"title\")} updatedAt={doc.get(\"updatedAt\")[:10] if doc.get(\"updatedAt\") else \"?\"} private={doc.get(\"isPrivate\")}')
" 2>/dev/null

# Export a specific document — full Markdown content
DOC_ID="your-document-id"
curl -s -X POST "${OUTLINE_URL}/api/documents.export" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{\"id\":\"${DOC_ID}\"}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if d.get('ok'):
    print(d.get('data','')[:500])
" 2>/dev/null

# List all users — admin can enumerate all team members
curl -s -X POST "${OUTLINE_URL}/api/users.list" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"limit":100}' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if d.get('ok'):
    users = d.get('data',[])
    print(f'Users: {len(users)}')
    for u in users[:10]:
        print(f'  [{u.get(\"id\")}] {u.get(\"name\")} email={u.get(\"email\")} role={u.get(\"role\")} isAdmin={u.get(\"isAdmin\")}')
" 2>/dev/null

.env Credential Extraction: SECRET_KEY, S3, OAuth, Database

# Outline .env credential extraction

# .env file — contains all secrets for Outline
cat /var/www/outline/.env 2>/dev/null | grep -E "SECRET_KEY|AWS|SLACK|GOOGLE|DATABASE|SMTP|OIDC"

# KEY credentials to extract:
# SECRET_KEY — 32-byte hex string used for session cookie signing
#   → enables forging session tokens as any user
# DATABASE_URL — full PostgreSQL DSN including password
#   → postgres://outline:PASSWORD@localhost/outline
# AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY — S3 credentials for document storage
#   → enables downloading all document attachments and images from S3
# AWS_S3_UPLOAD_BUCKET_NAME — the S3 bucket containing all uploaded files
# SLACK_CLIENT_SECRET — OAuth2 secret for Slack SSO
#   → enables impersonating the Slack OAuth app
# GOOGLE_CLIENT_SECRET — OAuth2 secret for Google SSO

# Docker deployment
docker inspect outline 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['SECRET','AWS','SLACK','DATABASE','GOOGLE','PASSWORD']):
            print(e)
" 2>/dev/null

# PostgreSQL direct access — users and API tokens
psql "postgres://outline:PASSWORD@localhost/outline" 2>/dev/null << 'EOF'
-- All users with email and authentication provider
SELECT id, name, email, role, "createdAt", "lastActiveAt",
       "isAdmin", "isSuspended"
FROM users
ORDER BY "isAdmin" DESC, "lastActiveAt" DESC
LIMIT 20;
EOF

# API tokens table — all active API tokens
psql "postgres://outline:PASSWORD@localhost/outline" 2>/dev/null << 'EOF'
SELECT t.id, t.name, t."userId", u.email, t."lastActiveAt",
       t.hash  -- SHA-256 hashed token
FROM api_keys t
JOIN users u ON t."userId" = u.id
ORDER BY t."lastActiveAt" DESC
LIMIT 20;
EOF

# S3 bucket access with extracted credentials
AWS_ACCESS_KEY_ID="extracted-key" AWS_SECRET_ACCESS_KEY="extracted-secret" \
  aws s3 ls s3://outline-uploads-bucket/ --recursive 2>/dev/null | head -20
# Lists all uploaded document attachments and images

Outline Security Hardening

Outline Security Hardening Checklist:

Generate a strong SECRET_KEY and protect the .env file — Outline's SECRET_KEY is a 32-byte random hex string used for signing session cookies; compromise of this value enables forging valid session cookies as any Outline user without knowing their password; generate a new SECRET_KEY using openssl rand -hex 32 and restrict .env to 600 owned by the Outline process user; for Docker deployments use Docker secrets or an external secrets manager rather than .env files; never commit .env to version control; rotate SECRET_KEY immediately if it has been exposed, which will invalidate all existing sessions (users must re-authenticate via SSO)
Use S3-specific IAM credentials with minimal permissions — Outline stores all document attachments and uploaded images in S3; the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in .env should belong to an IAM user with permissions limited to the specific S3 bucket used by Outline and only the required actions (s3:PutObject, s3:GetObject, s3:DeleteObject); do not use root account credentials or overprivileged IAM user credentials; configure S3 bucket policies to restrict access to the Outline IAM user only; for AWS deployments, use IAM instance roles instead of access key credentials to eliminate the credential from the environment entirely
Restrict Outline to SSO providers with strong identity verification — Outline's authentication relies entirely on SSO providers (Slack, Google, OIDC); the SLACK_CLIENT_SECRET and GOOGLE_CLIENT_SECRET authenticate the OAuth 2.0 application; if these secrets are compromised, an attacker can impersonate the OAuth app and perform authorization code interception; rotate OAuth application secrets immediately if exposed; for internal wikis, use an internal OIDC provider (Keycloak, Authentik) with corporate account enforcement rather than public Slack/Google OAuth which allows any Slack workspace member to potentially authenticate
Restrict document visibility and API token scope — Outline's document visibility defaults to the entire team; private collections and documents are available to members of that collection but admin API tokens bypass collection-level restrictions; implement a least-privilege approach: use private collections for sensitive documents (runbooks with credentials, security assessments, personnel information); audit API tokens regularly via admin panel > API Tokens; API tokens inherit the creating user's permissions, so admin-created tokens have full read/write access to all documents; revoke unused tokens; consider implementing read-only API tokens for integrations that only need to read content
Secure the DATABASE_URL and PostgreSQL instance — Outline's DATABASE_URL contains the full PostgreSQL connection string including the password; direct PostgreSQL access provides complete access to all documents, users, API tokens (SHA-256 hashed), and team configuration; restrict PostgreSQL to localhost or the Outline container network; use a dedicated database user with permissions only on the Outline database; configure PostgreSQL pg_hba.conf to require password authentication from all connections; never expose PostgreSQL port 5432 to the public internet

Security Test	Method	Risk
SECRET_KEY extraction and session token forgery	Read .env SECRET_KEY — 32-byte hex session signing key; forge valid session cookies for any Outline user bypassing SSO authentication entirely	Critical
AWS S3 credential extraction and document bucket access	Read .env AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY; aws s3 ls s3://bucket/ — all uploaded document attachments, images, and exports; may contain credentials and sensitive internal documents	Critical
API document and collection enumeration	POST /api/documents.list — all team documents; POST /api/documents.export returns full Markdown content of any document; complete access to team knowledge base	High
Slack/Google OAuth secret extraction	Read .env SLACK_CLIENT_SECRET/GOOGLE_CLIENT_SECRET — OAuth application secrets; enables authorization code interception and SSO session hijacking	Critical
DATABASE_URL PostgreSQL credential extraction	Read .env DATABASE_URL — full connection string with password; direct PostgreSQL access to all Outline data including user table and SHA-256 hashed API tokens	Critical

Automate Outline Security Testing

Ironimo tests Outline deployments for .env SECRET_KEY extraction and session forgery, AWS S3 credential extraction with bucket enumeration and document download, Slack/Google OAuth secret exposure, DATABASE_URL PostgreSQL credential extraction, REST API document and collection enumeration, user email harvesting, API token audit, Docker environment variable credential exposure, S3 bucket policy misconfiguration, and PostgreSQL network exposure on port 5432.

Start free scan

Table of Contents

Authentication and API Token Testing

REST API Document and User Enumeration

.env Credential Extraction: SECRET_KEY, S3, OAuth, Database

Outline Security Hardening

Automate Outline Security Testing