paul
2b5b875dfe
BREAKING CHANGE: Server now requires JWT_SECRET environment variable to be set Security fixes: - Remove hardcoded JWT secret fallback 'your-secret-key' from protectedImages.js - Add startup validation to ensure JWT_SECRET is properly configured - Reject insecure default values and short secrets - Server will refuse to start without proper JWT_SECRET This fixes a critical vulnerability where the application would use a publicly known secret if JWT_SECRET was not set, completely compromising authentication. Migration guide: docs/JWT_SECRET_MIGRATION.md 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Photo Sharing Platform
A secure, self-hosted photo sharing platform designed for weddings and events. Features automatic expiration, email notifications, and simple file-based management.
Features
- 🔒 Password Protected Galleries
- ⏰ Automatic Expiration
- 📧 Email Notifications
- 📁 Simple File Management
- 📊 Analytics Integration
- 🎨 Customizable Themes
- 📱 Mobile Responsive
- ⚡ Docker Ready
Quick Start
- Clone the repository
- Run
./scripts/install.sh - Configure
.envfile - Setup SSL:
./scripts/setup-ssl.sh - Start:
docker-compose -f docker-compose.prod.yml up -d
Default credentials: admin / admin123 (change immediately!)
Documentation
See DEPLOYMENT.md for detailed deployment instructions.
License
MIT License