# Security

## Access model

- Every `/image-previews/*` endpoint requires an authenticated **Directus admin** (session or admin
  token). Non-admin requests receive `403`.
- The admin module is only reachable from the Directus admin app.
- There is no separate token mechanism and no unauthenticated write path.

## Operational guidance

- Do not expose a production admin token to automation. For autonomous/remote workflows, use a staging
  instance and least-privilege access.
- The extension generates transforms in-process; it does not accept image URLs or arbitrary file paths
  from clients.
- Persisted state lives under `<STORAGE_LOCAL_ROOT>/.image-previews` and contains no secrets.
- Uploaded file contents are never logged; only file ids, preset keys, formats, timings, and error
  messages.

## Reporting a vulnerability

Please report security issues privately to **rawman@locus.im** rather than opening a public issue.