Glimmer HD Vision is an unauthenticated local inference service. Bind it to loopback or place it behind an authenticated reverse proxy on a trusted network. Do not expose the listener directly to the public internet.
The default launcher binds to 127.0.0.1. Changing GLIMMER_LISTEN_HOST to a non-loopback address is an explicit operator decision.
The proxy accepts base64 data URIs and HTTP(S) image URLs. Before the proxy itself downloads a remote image for tiling, it resolves the hostname once, requires every resolved address to be globally routable, and connects directly to one of those validated IP addresses. HTTP preserves the original Host header; HTTPS additionally preserves TLS SNI and certificate verification. Redirects are refused rather than followed, closing redirect-to-private and DNS-rebinding paths in the proxy's own fetch.
If tiling cannot load an image, the compatibility behavior still passes the original image_url block to the downstream model server. Therefore:
- the pinned fetch protects the proxy's preprocessor, but this proxy is not a complete downstream SSRF firewall;
- URL-fetch behavior must also be controlled at the model server or network-egress layer;
- untrusted clients should not be allowed to submit arbitrary image URLs;
- production deployments should prefer uploaded data URIs, an allowlisted media service, or egress filtering.
The implementation enforces:
- 128 MiB maximum request body;
- 32 MiB maximum image download/data URI;
- 100 million decoded pixels per image;
- at most two tiled source images by default.
These are denial-of-service bounds, not a guarantee that a request fits GPU context or memory. Apply reverse-proxy body, concurrency, and rate limits as well.
The JSONL proxy log records client addresses and the child argv. The child log can contain prompts or model-server diagnostics depending on upstream logging settings. Store both with restricted permissions and a bounded retention policy.
Images and embedded document text are untrusted model input and may contain prompt injection. A vision model description must not be treated as authorization for tool calls or irreversible actions. Keep normal agent confirmation, sandboxing, and data-minimization controls in place.
Use GitHub's private vulnerability reporting for this repository. Do not include secrets, private images, credentials, or production logs in a public issue.