Security

A transform endpoint is, by definition, a "fetch any URL" engine — so it must be guarded. Keenpix treats that as core, not a fast-follow.

The allowlist (access control)

Each project has a list of allowed source hosts. A request is served only if the source URL's host is on that project's list. The list is checked before the cache, and an empty list blocks everything (fail-closed). This is why a transform URL needs no API key: it is safe to publish, because it can only ever hit hosts you've approved.

(Keenpix does have optional internal API keys for trusted backend systems that manage projects over the JSON API — those are separate from the public transform endpoint. See Projects & access and the SDK API reference.)

How does Keenpix prevent SSRF?

Even for an allowed host, Keenpix refuses to become a proxy into your private network:

• Private/internal IPs are blocked — loopback, RFC-1918, link-local, CGNAT, IPv6 unique-local / link-local / multicast, and IPv4-mapped IPv6 forms.
• The resolved IP is pinned into the connection, closing the DNS-rebinding window between the check and the connect.
• Every redirect hop is re-validated, so a 302 to an internal host is refused.

Denial-of-service guards

• Origin responses are size-capped (streamed with a byte ceiling → 413).
• sharp runs with a limitInputPixels ceiling and failOn: 'truncated'.

The HTTP transform runtime coalesces identical in-flight work within one process, but it does not currently expose a global transform-concurrency setting. Operators should add bounded admission control at the proxy or orchestrator and shed excess cold work before the host reaches its memory limit. See the cache stampede and capacity guide.

Hotlink and cache-busting protection

The allowlist gates which origins Keenpix fetches from; it does not stop a third party from requesting your public transform URLs with junk query params to force cache misses. For that, enable signed URLs per project: every request must then carry a valid HMAC sig= parameter or it gets a 403.

Sign-in

The dashboard is bootstrapped with a super admin account. Set KEENPIX_SUPER_ADMIN_EMAIL and KEENPIX_SUPER_ADMIN_PASSWORD before running the seed or Docker container. The super admin can create copyable invitation links for other staff from Settings → Staff. Email delivery is optional and uses SMTP configured from Settings → Email first. SMTP environment variables are only used as a fallback when Settings SMTP is disabled or incomplete.