Vane combines SearXNG results with model-written answers
Vane is a self-hosted answer engine in the Perplexity mold. A query goes through SearXNG or another configured search path, relevant pages feed a language model, and the interface returns a synthesized answer with citations. Users can choose speed, balanced, or quality modes; search the web, discussions, or academic material; restrict a query to a domain; and retrieve images or videos beside text results. File uploads and local search history extend it beyond a metasearch front end.
The application supports local models through Ollama and hosted providers including OpenAI, Anthropic, Gemini, and Groq. That flexibility is useful when privacy, price, and answer quality pull in different directions. A local model can keep prompts on your hardware, while web search still sends queries to the engines reached through SearXNG. Hosted models move the synthesized context to their APIs. Local therefore describes one part of the path, not every network request.
The repository is small in file count, with 238 files and about 17,718 lines of source in our measured checkout. The product surface is much larger: discovery feeds, widgets, suggestions, document handling, several research modes, provider adapters, scraping, embeddings, and an API. That mismatch helps explain why a short source tree can still pull more than 2 GB of dependencies.
The bundled container is simple until a model sits outside it
The recommended Docker command starts one image containing Vane and SearXNG, publishes port 3000, and attaches persistent data storage. A browser setup screen then collects model and provider settings. Users with an existing SearXNG can run the slim image, but their search service must allow JSON output and enable Wolfram Alpha according to the README. These paths are much easier than assembling the Node application and metasearch service separately.
Local Ollama introduces a common container-network trap. On Windows and macOS, the guide points the application at host.docker.internal; on Linux, it suggests the host's private address and may require Ollama to listen on 0.0.0.0. That solves reachability by widening the listener. Operators should bind, firewall, and route it deliberately rather than copy the setting onto a publicly reachable host. The same concern applies to other OpenAI-compatible local servers.
Hosted providers avoid that local networking step but need API keys and introduce usage costs. Vane saves settings and search history locally, so backups contain more than anonymous application data. Decide who can read the volume, how uploaded documents are removed, and where provider secrets appear before using it for confidential research.
What happened when we ran it
Our sandbox install at commit 7dc5d08 succeeded in 274 seconds, pulled 1,051 packages, and expanded to 2,039 MB on disk. The build completed in 91 seconds. We used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node 22, and no secrets. The checkout itself occupied 37.3 MB before dependencies, so installation multiplied the disk footprint dramatically.
The harness found no test script or target and skipped tests. That is not a failed suite, but it leaves us without a measured behavior baseline. The repository had no tests directory, 1 CI workflow file, and a Dockerfile. A successful 91-second build proves the application compiled in our clean environment; it does not establish that search, scraping, citations, model streaming, uploads, or provider settings work correctly together.
No vulnerability audit result was supplied in the lab block, so this review makes no claim about dependency findings. The decision-relevant facts are already substantial: 1,051 packages, 2,039 MB on disk, a green build, and no runnable test target. A team adopting Vane should create smoke tests for its chosen model and search provider instead of assuming the interface covers every integration path.
Missing authentication makes public exposure unsafe
The README says Vane works on a local network and can remain accessible with port forwarding. The same document lists authentication under upcoming features. Those two facts should not be combined into a public deployment recipe. Without an access layer, anyone who can reach the service may be able to search, inspect history, upload files, or consume configured provider capacity, depending on the current application behavior. Put it behind authenticated infrastructure or keep it on a trusted private network.
Issue 1180 raises a sharper concern: API keys exposed to client-side code when Vane is deployed publicly. The report remained open in August. Even if a reverse proxy adds login, a credential delivered to the browser can be extracted by an authorized user or script. Verify key storage and request routing in the exact release before sharing access. An answer engine that protects search privacy should not receive the benefit of the doubt around provider secrets.
Other current reports describe searches hanging on Brainstorming, provider settings resetting after a container restart, generic fetch failures, and search breaking after updates. Release v1.12.2 says it added timeouts, isolated widget errors, fixed upload handling, and changed scraping and result filtering. Those fixes address real failure modes, while the remaining issues argue for a private trial with disposable keys.
Issue activity continued after code pushes stopped
The last recorded push was 2026-04-11, one day after v1.12.2 was published. GitHub showed 348 open issues and PRs, with discussions and submissions updated through 2026-08-24. Recent pull requests covered discussion search, Notion work, dependency updates, and parsing fixes; recent issues covered search failures, networking, provider persistence, and security. The activity is not an abandoned-project signal, but neither is it the same as merged maintenance on the main branch.
Vane is appealing as a private home-lab search interface because the bundled container lowers the first-run burden and local models are supported. Our measurements make the trade plain: the source path is heavy, no tests ran, and the current public-exposure story is unfinished. Keep it private, use low-value provider keys during evaluation, and verify citations against their source pages.