Repository navigation
Security
Albm is a single-admin, self-hosted app. There is one admin identity (password and/or passkeys); there are no visitor accounts. Client galleries are reached at unguessable URLs and may be individually password-protected. TLS is expected to be terminated by a reverse proxy in front of the app.
The app makes no outbound network requests by default, except an optional daily
GitHub release check (DISABLE_UPDATE_CHECK=1 turns it off). If you configure SMTP in
Settings → Email, it will also send outbound mail for new-inquiry notifications — this
stays off until you set it up. Likewise, pasting a Google Analytics snippet in
Settings → Analytics only sends pageviews unless you separately check "Also send
custom events" there — and even then, nothing fires until a visitor accepts the
cookie-consent banner (Google Consent Mode v2). Client-gallery events never send a
title, slug, or client name to Google — only the gallery's opaque internal ID.
Canonical policy in the repo: SECURITY.md.
- Set a strong
SESSION_SECRET(openssl rand -hex 32) and keep it stable across restarts. - Set
ADMIN_PASSWORD_HASH, or register a passkey and prefer passkey login. - Serve only over HTTPS (WebAuthn/passkeys require a secure origin). Set
BASE_URLto that https origin. - Back up
DATA_DIR— it holds your database and photos. Migration backups land inDATA_DIR/backups/. - Treat upload tokens as secrets; they are shown once, never logged server-side, and can upload, replace, and delete photos in any gallery — revoke a leaked one immediately in Settings → Sharing.
- Pin the container image version in production instead of
:latest.
Please report security issues privately — do not open a public issue.
Use GitHub’s “Report a vulnerability” (Security → Advisories) on the repository, or email the maintainer. Include steps to reproduce and the affected version. You’ll get an acknowledgement as soon as possible, and a coordinated disclosure once a fix is available.