Rawman Grey
94f197bdec
- add repository/homepage/bugs metadata; target Directus ^11 - genericize internal deployment references - document install, compatibility, scheduling, security - stop tracking internal .opencode work artifacts
22 lines
935 B
Markdown
22 lines
935 B
Markdown
# Security
|
|
|
|
## Access model
|
|
|
|
- Every `/image-previews/*` endpoint requires an authenticated **Directus admin** (session or admin
|
|
token). Non-admin requests receive `403`.
|
|
- The admin module is only reachable from the Directus admin app.
|
|
- There is no separate token mechanism and no unauthenticated write path.
|
|
|
|
## Operational guidance
|
|
|
|
- Do not expose a production admin token to automation. For autonomous/remote workflows, use a staging
|
|
instance and least-privilege access.
|
|
- The extension generates transforms in-process; it does not accept image URLs or arbitrary file paths
|
|
from clients.
|
|
- Persisted state lives under `<STORAGE_LOCAL_ROOT>/.image-previews` and contains no secrets.
|
|
- Uploaded file contents are never logged; only file ids, preset keys, formats, timings, and error
|
|
messages.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report security issues privately to **rawman@locus.im** rather than opening a public issue.
|