Starting with v0.104.0, some features in Trilium are intentionally disabled in order to reduce the attack surface:

- Backend scripts, which can run processes on the server, access the file system or bypass security measures.
- SQL Console, which can be used to exfiltrate important data such as the document secret or cause irreparable damage to the database.
- Network Access for the Desktop Installation.

To activate any of them, there are three variants:

- For the desktop app, go to Options → Security and toggle the desired option.
  - This will prompt a system dialog confirming the change. Note that scripts could potentially call this confirmation dialog as well, make sure to accept it only if enabling any of these features is required.
  - The settings page will be available for the server-side as well, but the options need to be manually toggled using the other mechanisms described here.
  - This works by setting a separate configuration file in the Data directory.
- In config.ini, set the corresponding option under the `Security` group.
- Or use environment variables (e.g. `TRILIUM_SECURITY_BACKEND_SCRIPTING_ENABLED=true`).