What self-hosting Vane gives you
Vane lets you host the answering application and choose its model provider. That makes it a candidate for readers seeking more deployment control than a hosted answer engine provides. It does not make privacy or answer accuracy a measured result.
The README describes SearxNG-backed search, cited answers, Speed, Balanced and Quality modes, file uploads, local search history and an API. It lists Ollama alongside hosted providers including OpenAI, Anthropic Claude, Google Gemini and Groq. Those are documented capabilities, not features exercised by our setup run. A local model changes where model processing happens; web search still involves external services, and a hosted model introduces another provider into the request path.
What our recorded run established
Our run was recorded on September 28, 2026 at commit 348feca3e378fb4157b217724ed508dc707f853f. Dependency installation completed successfully in 274 seconds. The build command then completed successfully in 125 seconds. Together, those two steps took about 399 seconds; the harness recorded 460 seconds for the overall run.
The recorded dependency count was 1,051, with a dependency-install footprint of 2,039 MB. The repository measurements were 238 files, approximately 17,718 source lines and 37.3 MB. These figures describe this checkout and setup run. They do not measure a deployed Docker image, model weights, saved conversations or runtime memory consumption.
The sandbox configuration specified 3 CPUs, 8 GB of memory and image lab-node:22. That image label alone does not verify the runtime version. No new execution was performed for this correction.
A successful exit needs one qualification here: the build output included errors parsing /work/repo/data/config.json and messages about loading default configuration. The command still exited with code 0. We therefore record build-command success with configuration errors in its output, rather than calling the build error-free or treating those messages as proof that the product cannot run.
Tests were skipped because the harness found no test script. Its detector also recorded no test directory, one CI workflow and a Dockerfile. This is a detection result, not an exhaustive inspection proving that the repository contains no tests. No dependency audit result was recorded, and audit coverage is unknown.
The run did not establish application startup, a completed provider connection, live search performance, citation accuracy, sustained memory use or security. Installing dependencies and completing a build do not establish an installed, functioning search service.
Setup still includes search and model configuration
The README recommends Docker and says the full image bundles Vane with SearxNG. Its slim image connects to an existing SearxNG instance. The documented volume preserves application data and uploaded files. We did not pull or run either image in the recorded measurement.
For non-Docker installation, the README calls for SearxNG with JSON output and Wolfram Alpha enabled, followed by dependency installation, a build and application startup. Provider settings are configured through the setup screen. Our harness used Yarn for dependency installation; the README's non-Docker instructions use npm. The measured times should not be presented as timings for that npm procedure.
For Ollama connectivity, the README documents host.docker.internal on Windows and macOS and a reachable host private address on Linux. Its Linux instructions include an Ollama listener on 0.0.0.0. Restrict access to that listener when following the networking instructions. The run did not test these connections.
Deployment cautions are reports, not our security findings
The supplied README lists authentication under upcoming features. Issue #1155 alleges unauthenticated configuration access, provider-key disclosure, configuration changes and arbitrary provider base URLs. We did not reproduce these allegations or establish which deployed versions are affected. Given the documented authentication status and that report, use an access-control layer before making an evaluation reachable from an untrusted network.
Issue #1204 reports reversed model-name and API-key fields when configuring a local OpenAI-compatible model in version 1.12.2, with the key appearing as the model name in logs. The reporter distinguishes this from provider configuration, which they say works. We did not reproduce the issue. Check the exact configuration path and logs with a disposable credential before supplying a paid key.
These reports justify checks during evaluation. They do not turn our successful build into a security assessment or establish that every deployment has the reported behavior.
Choosing an alternative
Open WebUI is relevant when administration matters alongside model chat. Its README documents administrator-defined roles, groups and permissions. That is a reason to investigate it for a shared interface, not evidence that we verified its access controls.
Khoj is relevant when your own documents are central to the questions you ask. Its README describes answers from the internet and documents including PDFs, Markdown, org-mode, Word and Notion files. We did not compare its retrieval quality or setup requirements with Vane.
How to read the scores
These are editorial ratings of the supplied evidence, not benchmark results. The rubric is 1 for major documented barriers, 2 for material unresolved limits or limited verification, 3 for a documented path with partial verification, 4 for broad documentation or verification with minor gaps, and 5 for strong evidence across the relevant scope. Unknown adoption, compatibility and runtime behavior earn no extra credit.
Vane's setup score reflects successful dependency installation and build commands, with startup and search unverified. The documentation score reflects the README's concrete installation and networking instructions. Community evidence is limited to the supplied support channels and issue discussion; it does not establish adoption or response times. Maturity remains a cautious rating because runtime behavior was not tested and deployment concerns remain unverified.
The next useful step is a restricted trial of your actual provider and search configuration: start the application, complete a search, inspect its citations and logs, and check access controls. Our recorded setup run cannot answer those questions for you.