The app holds this phone's own key to your Opensolr account and reads private photos, so it is built to give an attacker as little as possible on every surface.
Browser-only login with PKCE; exact client and redirect matching; one-time 60-second codes stored as hashes and redeemed atomically; approval page that cannot be framed, with CSRF; state checked in constant time. See signing in.
AES-256-GCM under a key generated inside the Android Keystore, which never leaves it; tampered values are rejected; no backups.
HTTPS only, cleartext disabled for the whole app; system certificate authorities only; no redirects followed on any call that carries a credential; account credentials in request bodies and index credentials in the Authorization header, never in URLs.
Typed text only as a bound parameter; every filter value as a bound value of a terms filter; page size clamped; a search by meaning checked again by Opensolr before it reaches your index. See why nothing you type can change the query.
Opensolr identifies each picture by its bytes, accepts only image formats, at most 20 MB and, on a photos index, at most 1024 px on the long edge, and keeps no picture. What it keeps is what it read out of a picture, against a fingerprint of the picture's bytes, so reading the same one again costs nothing. See privacy.
Its own HTTP credentials over HTTPS. The uploaded configuration has no library directives, script processors, remote streaming or template writers.
Every release signed with one key; its certificate fingerprint is published in assetlinks.json, which is also what binds the sign-in callback to this app.
| If someone has | They can | They cannot |
|---|---|---|
| A sign-in code seen in an address bar or a log | Nothing: it dies after 60 seconds or one use | Redeem it without the verifier, which never leaves the app |
| Another app that registered the same URL scheme | Receive a code on the fallback path | Redeem it without the verifier |
| A copy of the app's private files | Encrypted values | Decrypt them away from the phone |
| Your unlocked phone | Use the app as you would | Read your Opensolr password, which the app never had |
| A lost or stolen phone, signed out in Account › Devices | Nothing on Opensolr: its key is refused at once and its photo index has new credentials | Reach your account or your other indexes |
| A malicious photo file | Have it refused by the server's upload checks | Get it treated as anything but an image |
The key the app receives belongs to this phone alone, never the account's master key, but it can use every API endpoint of your account. Anyone who controls your unlocked phone controls what that key controls. If a phone is lost, sign it out in Account › Devices: its key stops working at once, its photo index gets new credentials, and your other phones and your master key are not touched.
Email support@opensolr.com with Opensolr Photos security in the subject: the app version, the steps to reproduce, and what an attacker could achieve. Please do not open a public issue for a vulnerability.
Trust
- Privacy
- Security model