The app holds an account key and reads private photos, so it is built to give an attacker as little as possible on every surface.
Browser-only login with PKCE; exact client and redirect matching; one-time 60-second codes stored as hashes and redeemed atomically; approval page that cannot be framed, with CSRF; state checked in constant time. See signing in.
AES-256-GCM under a key generated inside the Android Keystore, which never leaves it; tampered values are rejected; no backups.
HTTPS only, cleartext disabled for the whole app; system certificate authorities only; no redirects followed on API calls; credentials in request bodies, never in URLs.
Typed text only as a bound parameter; every filter value through the term parser with a bound value; page size clamped.
The server identifies each picture by its bytes, requires two independent parsers to agree on an allowed format, checks the declared pixel count before decoding, and stores nothing.
Its own HTTP credentials over HTTPS. The uploaded configuration has no library directives, script processors, remote streaming or template writers.
Every release signed with one key; its certificate fingerprint is published in assetlinks.json, which is also what binds the sign-in callback to this app.
| If someone has | They can | They cannot |
|---|---|---|
| A sign-in code seen in an address bar or a log | Nothing: it dies after 60 seconds or one use | Redeem it without the verifier, which never leaves the app |
| Another app that registered the same URL scheme | Receive a code on the fallback path | Redeem it without the verifier |
| A copy of the app's private files | Encrypted values | Decrypt them away from the phone |
| Your unlocked phone | Use the app as you would | Read your Opensolr password, which the app never had |
| A malicious photo file | Have it refused by the server's upload checks | Get it treated as anything but an image |
The key the app receives is the account API key, the same one your integrations use. Anyone who controls your unlocked phone controls what that key controls. If a phone is lost, change the account's API key, which stops the app's calls to Opensolr, and change the HTTP password of the phone's index in its Security tab, which stops direct access to the index.
Email support@opensolr.com with Opensolr Photos security in the subject: the app version, the steps to reproduce, and what an attacker could achieve. Please do not open a public issue for a vulnerability.