PhotoAlbum is a local-first desktop app: your library never leaves your PC, and the only network surface is a loopback REST API (127.0.0.1:5150) protected by a per-install token. See Data, privacy & security for the full model.

Only the latest release receives fixes. Please reproduce a problem on the newest release before reporting it.

Please do not open a public issue for a security problem. Use GitHub's private reporting instead: Security → Report a vulnerability on https://github.com/dpevzner1/PhotoAlbum/security/advisories/new.

Include the version (Settings → About), what you did, what you expected, and what happened. Expect an acknowledgement within a few days; this is a volunteer project, so fixes are made on a best-effort basis.

• Anything that lets another process, user or website read or change the library through the API without the token (e.g. token bypass, DNS-rebinding, CORS, path traversal in /media/{id}/file or the export/copy endpoints).
• Bypassing the hidden vault exclusion or the destination guard (writing to drive roots, Windows, Program Files, ProgramData).
• Code execution via crafted media metadata or a crafted photoalbum-metadata.json.
• Anything that modifies original photo files without an explicit user action.

• The SQLite catalog is not encrypted (it lives in your user profile; use disk encryption such as BitLocker).
• Software running as you can read %LOCALAPPDATA%\PhotoAlbum\api-token.txt — the token protects against other origins and users, not against your own account.
• The MSI is not code-signed yet (SmartScreen shows Unknown publisher). Verify the published SHA-256.

Never commit photos, library.db, api-token.txt, logs, device serial numbers or personal paths. python tools/release.py stage and .gitignore exclude the usual suspects; review git status before you push.