If you've ever self-hosted a file-sharing tool and then found out weeks later that some rando on the internet had already made themselves admin, you know the exact bad feeling I'm describing.
I ran into this with Pingvin Share, the open-source WeTransfer alternative (expiring links, password protection, reverse shares where someone can upload to you with no account, OIDC/OAuth/LDAP support). It's a genuinely good project. But the original repo (stonith404/pingvin-share) got archived on 2025-06-29, and its own README now points people at a maintained fork, smp46/pingvin-share-x — 221 commits and 24 releases ahead.
The bigger issue isn't staleness though, it's the signup flow: Pingvin gives admin rights to whoever registers first, and registration is open by default. Deploy it stock and don't beat the internet to your own signup page, and someone else owns your file-sharing instance. I reproduced this on the stock image — anonymous POST /api/auth/signUp comes back 201 with "isAdmin":true. There's also a port mismatch worth knowing about if you're deploying this anywhere with a platform-injected port (Railway, Render, etc.) — the app's internal Caddy proxy is hardcoded to port 3000 and doesn't listen on whatever $PORT your platform hands it, so you can end up with a healthy-looking container serving 404 on every page.
I maintain a Railway template that runs the maintained fork and handles both of those before the instance is ever reachable — generates and seeds the admin password at boot with registration closed, and remaps the injected port so the proxy actually listens where your platform expects. Full disclosure: I get a kickback if you deploy through it. Link: https://railway.com/deploy/pingvin-share-x-v122-or-wetransfer-alter?referralCode=Z1xivh&utm_medium=integration&utm_source=template&utm_campaign=inventory
If you'd rather not use it, that's genuinely fine — the non-affiliated path works too: pull ghcr.io/smp46/pingvin-share-x directly, mount a volume at /opt/app/backend/data, and just make sure you register the admin account and close signups before you share the URL with anyone. That's the whole fix, template or not.
One honest tradeoff: it's SQLite-backed, single container, no external DB/cache — great for a small team or personal use, less great if you need horizontal scale or heavy concurrent uploads. For that use case it's solid.
Top comments (0)