Security

Private family photographs deserve deliberate protection. Security is a product feature, not a footer promise.

Protected photograph storage

Originals and browsing copies are stored outside directly accessible application routes and denied by Apache rules. Every image request passes through an authenticated endpoint that checks current ownership or active album sharing. Knowing a photo UUID is never enough.

Safe uploads

The server checks PHP upload status, byte size, detected file content, decoded dimensions and supported image type. JPEG, PNG and WebP are accepted; SVG is not. Internal filenames are randomly generated. Originals are preserved privately, while browsing copies are decoded and re-encoded with GD where available.

Accounts and sessions

Passwords are stored only through PHP’s current password-hashing API. Sessions use HttpOnly, SameSite cookies, rotate after authentication and are backed by revocable database records. Login and reset requests are rate-limited; reset, verification and invitation tokens are high-entropy, hashed in the database, expiring and single-use.

Request protection

State-changing forms require CSRF tokens. Database access uses native prepared statements. Output is escaped by default. Production expects HTTPS, security headers, protected dotfiles, no directory indexes and no script execution in storage.

Sharing, administration and auditing

Viewer and Contributor permissions are checked server-side. Revocation takes effect on the next request. Routine administration shows account status, plans, storage, failed jobs and security events—not a gallery of private photographs. Meaningful security and account actions are logged without captions, image content, raw tokens or GPS details.

What you can do

Use a long, unique password, keep your email account secure, sign out of shared devices and review unexpected sharing carefully. Please report a suspected vulnerability privately to familyalbum@backtwofront.com. Do not include another person’s photographs in an initial report.

Honest limitations

No system is completely secure. Production infrastructure, backups, monitoring, mail delivery and any later PayPal integration require deployment-specific hardening and review. We will not describe controls or certifications that are not actually in place.