23 lines
935 B
Markdown
23 lines
935 B
Markdown
|
# Security
|
||
|
|
|
||
|
|
## Access model
|
||
|
|
|
||
|
|
- Every `/image-previews/*` endpoint requires an authenticated **Directus admin** (session or admin
|
||
|
|
token). Non-admin requests receive `403`.
|
||
|
|
- The admin module is only reachable from the Directus admin app.
|
||
|
|
- There is no separate token mechanism and no unauthenticated write path.
|
||
|
|
|
||
|
|
## Operational guidance
|
||
|
|
|
||
|
|
- Do not expose a production admin token to automation. For autonomous/remote workflows, use a staging
|
||
|
|
instance and least-privilege access.
|
||
|
|
- The extension generates transforms in-process; it does not accept image URLs or arbitrary file paths
|
||
|
|
from clients.
|
||
|
|
- Persisted state lives under `<STORAGE_LOCAL_ROOT>/.image-previews` and contains no secrets.
|
||
|
|
- Uploaded file contents are never logged; only file ids, preset keys, formats, timings, and error
|
||
|
|
messages.
|
||
|
|
|
||
|
|
## Reporting a vulnerability
|
||
|
|
|
||
|
|
Please report security issues privately to **rawman@locus.im** rather than opening a public issue.
|