Chibisafe exposure begins at upload policy, not the download link
Chibisafe is a self-hosted file upload service with user accounts, API keys, albums, public links, and an admin dashboard. Its external footprint can look like a single upload page. The security review has to ask who can upload, who can list or delete files, and whether a public link is the only path to an object.
The official API documentation separates ordinary user routes from admin routes for user and file management. The project documentation also describes API keys for integrations and public upload behavior controlled by administrators. Those controls belong in the same review as storage quotas and file retention.
A small title set with a specific API
A ZoomEye SDK query for title="Chibisafe" returned 55 matches on 2026-11-01 at sub_type=all, page 1, and pagesize 1. The app="Chibisafe" query returned 0. Fifty-five is a modest title count, not a statement that the instances are safe. The product may be installed behind a custom title, and a public upload form may not identify the software.
The count only establishes that the exact title was observed. It does not show whether anonymous uploads are enabled, whether file contents are scanned, or whether a public file can be enumerated by UUID. Those are configuration and application tests.
Map the file lifecycle
List the upload entry points. Include the browser, API key routes, chunked upload endpoints, and any reverse-proxy route that bypasses the application. Confirm which routes require an authenticated user and which are intentionally public. Check the admin routes that approve, delete, or quarantine files.
Review API-key scope and lifetime. A key issued for an automation tool should not be able to manage users or purge public files. Test a key against an admin route after removing its user's admin role. The denial should occur regardless of the client used.
Examine how public links are generated and revoked. A random identifier can make guessing difficult, but the link may still be copied into a chat, support ticket, or browser history. Hash the storage path and record the link's owner. Test deletion and retention jobs with a disposable file.
Storage location matters as well. A container volume, object store, and thumbnail cache may have different access rules. Verify that a file removed from the application is also unavailable through a direct storage URL or a leftover static route.
The title count is a starting measurement. The useful decision comes from the upload, API, admin, and storage boundaries around it.
Top comments (0)