Security

Guests trust your site with photos of their families. This page lists what GuestLens does to keep those photos safe, and the few things that are your part.

What GuestLens does

• A file's type is read from the file itself, not from its name. Renaming a script to .jpg does not get it in.
• Uploads are stored outside your web root and served by GuestLens, so no request can reach a stored file directly or make the server run it.
• File addresses cannot be guessed. Each photo, video, and voice note has a long random key in its address, so nobody can list another event's files by counting. Private events also use links that expire.
• Location data is removed from photos. GuestLens takes it out of JPEG, PNG, and WebP photos. It cannot take it out of HEIC photos or videos, so guests never get a HEIC original, only the host does. Videos play for guests as they were recorded, so a video can still contain the place it was filmed.
• Location stamping is opt-in three times over. When you, the host, and the guest all say yes, the place the phone reports is saved in the database, never in the file, and only the host sees it. See Location stamping.
• Gifts are paid on Stripe's or PayPal's own page, so your server never sees a card number. A gift is counted only after the gateway confirms the exact amount.
• Originals stay with the host unless the host turns on "Let guests download photos". Guests see the display copy.
• PINs and passwords are hashed, and guessing is limited per phone, per network, and per event. Changing the PIN signs every phone out of the event.
• Emails always link to your own address. A request under a name that is not yours, or one of your events' hostnames, is refused, and password reset links are always built from APP_URL.
• Secrets stay encrypted. Payment keys, the S3 secret, and the mail password are stored encrypted, and stay encrypted in the cache too.
• Pages cannot be shown inside other sites, which stops a hidden button from being clicked through someone else's page.
• IP addresses are not stored in plain form. A salted hash is used for rate limits, and it is kept only in the cache for as long as the limit lasts.
• Each host only ever sees their own events. This is checked in the code on every database query, not by hiding links.
• Guest text is escaped when it is shown, so a guest cannot inject anything into a page.
• The installer locks itself when it finishes. See Install.
• Destructive actions are recorded in the audit log.

Your part

• Use HTTPS. Most panels give you a free certificate.
• Use a long password on the super admin account.
• Point your domain at the public folder if your host allows it. See Install, step 3.
• Keep PHP updated. Your host usually has a version selector.
• Keep APP_DEBUG=false in .env, except for a few minutes while you read an error.
• Back up your database on a schedule. On SQLite, back up the storage folder: it holds the database file and every photo and video.
• Keep your CRON_SECRET private.
• If you turn on location stamping or guest donations, say so in your privacy policy and your terms.
• If your site is behind Cloudflare or another proxy, set TRUSTED_PROXIES=* in .env. Otherwise every visitor seems to come from the proxy's address, and the limits per network would be shared by everyone.