b515880adb
Per-user Immich API keys were stored as plaintext in the users table, giving any attacker with DB read access full control over each user's Immich photo server. Keys are now encrypted on write with maybe_encrypt_api_key() and decrypted at the point of use via a shared getImmichCredentials() helper. A new migration (index 66) back-fills encryption for any existing plaintext values on startup. |
||
|---|---|---|
| .. | ||
| public | ||
| src | ||
| .env.example | ||
| package-lock.json | ||
| package.json | ||
| reset-admin.js | ||
| tsconfig.json | ||