Security

Thingfile is self-hosted, so the security of any given catalog is partly the software's job and partly the operator's. This page is the software's half: what it does today, stated so that where something is not done it says so rather than leaving you to assume.

Passwords

Passwords are hashed with Argon2id, the memory-hard algorithm recommended for password storage. The plaintext is never stored and never logged. A minimum strength policy is enforced at registration, and signing in takes the same amount of work whether or not the account exists, so the login form cannot be used to discover who has an account.

You can change your password from the web or the phone. It asks for the current one first, and changing it signs out every other session on the account in the same step, so a password someone else learned stops working everywhere, not just for new sign-ins.

Sessions

Signing in issues an opaque 32-byte random token, not a JWT, so it carries no readable claims. Only a SHA-256 of it is stored, so the session table is not a list of usable keys. Sessions expire after a period of inactivity and carry a hard ceiling regardless of use, so a session cannot live forever. Signing out revokes the token immediately, and you can revoke every session on your account at once from any device.

Photos and files

Item photos and attachments go to a private bucket or directory that is not publicly reachable. They are served back only through the authenticated API, checked against who may see the item: its owner, and the members of a collection it has been shared into. There is no shareable direct URL, and one account cannot read another's files by guessing an id.

Sharing

A collection is shared by invitation. Inviting an address gives the same answer whether or not it has an account, so the invite form cannot be used to find out who is registered, and nobody joins until they accept from their own account. A viewer can read the collection's items and nothing else; every change is refused on the server, not just hidden in the app. Someone outside a collection gets the same "not found" for its items as for things that do not exist. Removing someone, or their leaving, takes the items off their devices at the next sync.

Connected apps

Other software gets its own key rather than your password. Each key has a scope (read only, add items, or manage saved searches), is made only after you enter your password, is shown once, and is stored as a hash like a session. A key cannot change your password or make more keys, and each scope is enforced on the server: a read-only key is refused anything but reads. Revoking one under Connected apps takes effect immediately. Changing your password leaves keys alone, on purpose, so the page lists them for you to review.

In transit

The deploy module ships an nginx configuration that terminates TLS and sets HSTS, nosniff and framing headers, and the web app ships a Content-Security-Policy that lets it load scripts, styles and data from its own origin only. Serving your instance over HTTPS is ultimately the operator's call, and it is the one piece of this the software cannot make for you.

Abuse limits

Sign-in and registration are rate limited per network address. Image scanning and photo uploads (the operations that cost real work) are limited per account, so one busy account cannot degrade the service for others. Reads from eBay share one daily allowance, so they are rationed per account and per listing too.

Your half of it

Running an instance means the parts no application can do for you: keep the host patched, keep the database backed up and test that a backup restores, put it behind TLS, and decide who gets an account. If you enable image scanning, that also means the credentials it uses to call the model provider.

What Thingfile does not claim

• It is not end-to-end encrypted. The server can read the catalog and the photos on it. That is what makes server-side search and image labelling possible. On a personal instance that server is yours, which is rather the point; but if you run one for other people, they should know you can read their things.
• Password reset is not built yet. There is no email delivery in the system, so a forgotten password cannot currently be recovered self-service.
• Email addresses are not verified at registration, for the same reason. Nothing is emailed for an invitation either; whoever sends it has to tell the person.
• Registration says when an email is already taken. Signing in and inviting do not give that away; signing up does, as most sign-up forms do, because the alternative needs the email delivery above.

Reporting a problem

Email security@spergs.com. Please report privately rather than publicly, and give us a reasonable window to fix the issue before disclosure. Tell us what you did, what you expected, and what happened. A request id from the X-Request-Id header on the response helps us find it exactly.

Contact

Thingfile is built and published by Spergs, LLC, a Florida limited liability company. We do not operate instances, so a report here is about the software rather than about any particular deployment.
Security: security@spergs.com
Privacy: privacy@spergs.com