Rawman/directus-extension-generate-image-previews

Rawman Grey 94f197bdec chore: prepare for public release

- add repository/homepage/bugs metadata; target Directus ^11
- genericize internal deployment references
- document install, compatibility, scheduling, security
- stop tracking internal .opencode work artifacts

2026-10-25 12:25:19 +03:00

935 B

Raw Permalink Blame History

Security

Access model

Every /image-previews/* endpoint requires an authenticated Directus admin (session or admin token). Non-admin requests receive 403.
The admin module is only reachable from the Directus admin app.
There is no separate token mechanism and no unauthenticated write path.

Operational guidance

Do not expose a production admin token to automation. For autonomous/remote workflows, use a staging instance and least-privilege access.
The extension generates transforms in-process; it does not accept image URLs or arbitrary file paths from clients.
Persisted state lives under <STORAGE_LOCAL_ROOT>/.image-previews and contains no secrets.
Uploaded file contents are never logged; only file ids, preset keys, formats, timings, and error messages.

Reporting a vulnerability

Please report security issues privately to rawman@locus.im rather than opening a public issue.