Security

SECURITY.md

Security Policy

Supported versions

Pic2Album follows the currently maintained Nextcloud major versions configured in appinfo/info.xml.

Reporting a vulnerability

Please report security issues privately and do not open public issues containing exploit details.

When reporting, include:

affected Pic2Album version
affected Nextcloud version
exact reproduction steps
impact assessment (data leak, privilege escalation, account takeover, etc.)

Security design notes

State-changing endpoints use standard Nextcloud CSRF protection.
Authentication to DAV endpoints uses user app-passwords.
Sync operations are idempotent and avoid direct filesystem writes.
DAV paths are normalized and encoded before requests.

There aren't any published security advisories