docs: block custom components with env var (#12413)

* initial-changes

* fix-broken-links

* Apply suggestions from code review

Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>

---------

Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>

Author: mendonk

docs/docs/Deployment/deployment-block-custom-components.mdx

@@ -0,0 +1,24 @@
+---
+title: Block custom components
+slug: /deployment-block-custom-components
+---
+
+Custom components and the component code editor allow Langflow users to create and execute Python code in the Langflow runtime.
+While this freedom is a feature of Langflow, in some deployments you might want to block the creation of custom Langflow components to prevent arbitrary code execution.
+
+To block custom component creation on a Langflow server, set the following [environment variable](/environment-variables):
+
+```bash
+LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
+```
+
+When set to `false`, Langflow blocks creating custom components and changing code in the visual editor.
+
+When unset or `true`, Langflow allows custom code.
+Existing Langflow installations will keep the default `true` behavior until you opt in to this restriction.
+
+This environment variable is a beta feature, and should not be your only safeguard in production environments.
+
+In the event that Langflow could execute untrusted or LLM-generated code, run Langflow in an isolated and containerized execution environment.
+
+For more information, see [Security](/security).

docs/docs/Deployment/security.mdx

@@ -3,10 +3,8 @@ title: Security
 slug: /security
 ---
 
-The Langflow UI is an IDE and code execution platform, which means that Langflow is inherently capable of executing arbitrary,
-developer-provided code.
-By design, the Langflow UI includes a code editor allowing developers to author and execute arbitrary Python with full access to the host
-Langflow backend process, filesystem, and network.
+The Langflow UI is an IDE and code execution platform, which means that Langflow is inherently capable of executing arbitrary, developer-provided code.
+By design, the Langflow UI includes a code editor allowing developers to author and execute arbitrary Python with full access to the host Langflow backend process, filesystem, and network.
 In addition, some components wrap and use code execution, including use of AI models to generate code to be executed based
 on user input.
 
@@ -25,7 +23,8 @@ You are responsible for the following:
 Langflow is a code execution platform with full access to your local system.
 You are responsible for ensuring the safety of flows you execute.
 
-In the event that Langflow could execute untrusted or LLM-generated code, consider using isolated or containerized execution environments. For more information, see [Containerize a Langflow application](/develop-application).
+In the event that Langflow could execute untrusted or LLM-generated code, consider [blocking custom component execution](./deployment-block-custom-components.mdx) and running Langflow in an isolated and containerized execution environment.
+For more information, see [Containerize a Langflow application](/develop-application).
 
 ## Secure first-party deployments
 

docs/docs/Develop/environment-variables.mdx

@@ -433,6 +433,7 @@ See [Telemetry](/contributing-telemetry).
 | `LANGFLOW_AUTO_SAVING_INTERVAL` | Integer | `1000` | Set the auto-save interval in milliseconds if `LANGFLOW_AUTO_SAVING=True`. |
 | `LANGFLOW_BUNDLE_URLS` | List[String] | `[]` | A list of URLs from which to load custom bundles. Supports GitHub URLs. If `LANGFLOW_AUTO_LOGIN=True`, flows from these bundles are loaded into the database. |
 | `LANGFLOW_COMPONENTS_PATH` | String | Not set | Path to a directory containing custom components. Typically used if you have local custom components or you are building a Docker image with custom components. |
+| `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` | Boolean | `True` | If `false`, disables custom components and in-editor editing of component code. This feature is in beta. For more information, see [Block custom components](../Deployment/deployment-block-custom-components.mdx). |
 | `LANGFLOW_LOAD_FLOWS_PATH` | String | Not set | Path to a directory containing flow JSON files to be loaded on startup. Typically used when creating a Docker image with prepackaged flows. Requires `LANGFLOW_AUTO_LOGIN=True`. |
 | `LANGFLOW_CREATE_STARTER_PROJECTS` | Boolean | `True` | Whether to create templates during initialization. If `false`, Langflow doesn't create templates, and `LANGFLOW_UPDATE_STARTER_PROJECTS` is treated as `false`. |
 | `LANGFLOW_UPDATE_STARTER_PROJECTS` | Boolean | `True` | Whether to update templates with the latest component versions when initializing after an upgrade. |

docs/docs/Support/release-notes.mdx

@@ -77,6 +77,11 @@ For all changes, see the [Changelog](https://github.com/langflow-ai/langflow/rel
     Please do not report security vulnerabilities through public GitHub issues or GitHub security advisories.
     For the full policy and what to include in a report, see the [Langflow Security Policy](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md).
 
+- Disable custom components
+
+    Set `LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false` to disable custom components and in-editor editing of component code.
+    For more information, see [Block custom components](../Deployment/deployment-block-custom-components.mdx).
+    
 ## 1.8.x
 
 Highlights of this release include the following changes.

docs/sidebars.js

@@ -270,6 +270,11 @@ module.exports = {
             },
           ]
         },
+        {
+          type: "doc",
+          id: "Deployment/deployment-block-custom-components",
+          label: "Block custom components",
+        },
         {
           type: "doc",
           id: "Deployment/security",