Security model

Where the secrets live, how the network is locked down, and what an attacker can and cannot do.

The app holds an account key and reads private photos, so it is built to give an attacker as little as possible on every surface.

01 · Controls by surface
Sign-in

Browser-only login with PKCE; exact client and redirect matching; one-time 60-second codes stored as hashes and redeemed atomically; approval page that cannot be framed, with CSRF; state checked in constant time. See signing in.

Secrets on the phone

AES-256-GCM under a key generated inside the Android Keystore, which never leaves it; tampered values are rejected; no backups.

Network

HTTPS only, cleartext disabled for the whole app; system certificate authorities only; no redirects followed on API calls; credentials in request bodies, never in URLs.

Queries

Typed text only as a bound parameter; every filter value through the term parser with a bound value; page size clamped.

Uploads

The server identifies each picture by its bytes, requires two independent parsers to agree on an allowed format, checks the declared pixel count before decoding, and stores nothing.

The index

Its own HTTP credentials over HTTPS. The uploaded configuration has no library directives, script processors, remote streaming or template writers.

The APK

Every release signed with one key; its certificate fingerprint is published in assetlinks.json, which is also what binds the sign-in callback to this app.

02 · Threat model
If someone hasThey canThey cannot
A sign-in code seen in an address bar or a logNothing: it dies after 60 seconds or one useRedeem it without the verifier, which never leaves the app
Another app that registered the same URL schemeReceive a code on the fallback pathRedeem it without the verifier
A copy of the app's private filesEncrypted valuesDecrypt them away from the phone
Your unlocked phoneUse the app as you wouldRead your Opensolr password, which the app never had
A malicious photo fileHave it refused by the server's upload checksGet it treated as anything but an image
What the app hands out, stated plainly

The key the app receives is the account API key, the same one your integrations use. Anyone who controls your unlocked phone controls what that key controls. If a phone is lost, change the account's API key, which stops the app's calls to Opensolr, and change the HTTP password of the phone's index in its Security tab, which stops direct access to the index.

03 · Reporting a vulnerability

Email support@opensolr.com with Opensolr Photos security in the subject: the app version, the steps to reproduce, and what an attacker could achieve. Please do not open a public issue for a vulnerability.

Opensolr Photos is open source and MIT licensed. Questions about your Opensolr account, index or plan go to opensolr.com/contact; questions about the app itself belong on GitHub.

Opensolr Photos Documentation