Read 2026-10-04
immich-app/immich: technical due diligence, read from its repository
What Borehole read in immich-app/immich's code and history at 87e76d8: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | strong |
| Product & Engineering Maturity | adequate |
| Security & Reliability Posture | adequate |
| Observability & Operations | adequate |
| Fit with the Acquirer | not assessable |
What the repository says
- Releases are cut from another branch than the one surveyed
LICENSE: Relicensed: MIT → AGPL-3.0 (2024-02-12)CONTRIBUTING.md:26: states a policy on AI-generated contributions.gitmodules:1: 1 submodule(s) this survey does not read: e2e/test-assets
Architecture & Codebase — including AI provenance
strongpackages/sdk/src/fetch-client.ts is 8,456 lines, 128× this codebase's median file
adequateThe median source file here is 66 lines. 10 files exceed 1,000 lines, the largest being 8,456. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.
packages/sdk/src/fetch-client.ts:1 — 8,456 lines (128× median) |
server/src/queries/search.repository.sql:1 — 1,947 lines (29× median) |
server/src/enum.ts:1 — 1,298 lines (19× median) |
server/src/repositories/asset.repository.ts:1 — 1,260 lines (19× median) |
server/src/queries/sync.repository.sql:1 — 1,207 lines (18× median) |
Engineering Process & SDLC Maturity
strongTests are retried until they pass
adequateThe suite is configured to retry failing tests (e2e/playwright.config.ts). A retry turns a flaky test green without saying why it failed, so a green build means the tests passed eventually. Ask how many retries a typical run needs, and which tests need them.
e2e/playwright.config.ts:21 — test retry |
Product & Engineering Maturity
adequate81 direct dependencies in a single manifest
adequateserver/package.json declares 81 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.
server/package.json — 81 declared |
web/package.json — 45 declared |
machine-learning/pyproject.toml — 16 declared |
packages/cli/package.json — 6 declared |
Effort is shifting from building to rewriting
adequateDeleted lines per line added rose from 0.62 to 0.91 between the first and second halves of this history. Rework is normal and often healthy, but a rising ratio means an increasing share of the team's time is spent replacing code that already exists rather than building what does not. Whether that is deliberate repayment or churn is a question for the team.
| first half 0.62, second half 0.91 (split 2024-05-31) |
Releases are cut from another branch than the one surveyed
adequateThe newest release, v3.2.4, is not on the branch this survey read; the newest release on it is v3.1.0. The shipped product may differ from what this report describes. Survey the release branch too.
| tag v3.2.4 |
Security & Reliability Posture
adequate3 Dockerfiles run the application as root
adequateNo USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.
machine-learning/Dockerfile — runs as root |
packages/cli/Dockerfile — runs as root |
server/Dockerfile — runs as root |
1 environment file is committed
adequatedeployment/.env is tracked in git. Environment files are where credentials usually live, and committing one usually means nobody decided how secrets reach the running application. Whatever is in it is in the history for good. Check 05.1 says whether it holds anything credential-shaped.
deployment/.env — committed environment file |
54 locked dependencies have published vulnerabilities, 32 high or critical in what ships
adequate54 of 2,965 locked dependencies match 136 published advisories in OSV, 65 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.
machine-learning/uv.lock — anyio 4.2.0: GHSA-82r6-8w77-94w6 (critical), fixed in 4.14.2 |
pnpm-lock.yaml — tar 7.5.16: GHSA-23hp-3jrh-7fpw (critical), fixed in 7.5.19 |
pnpm-lock.yaml — tar 6.2.1: GHSA-23hp-3jrh-7fpw (critical), fixed in 7.5.19; a development dependency |
4 places insert HTML from a variable without sanitising it
adequate4 places set HTML from a value that is neither a literal nor passed through a sanitiser. Where the value can come from a user, that is stored cross-site scripting, and it is the first thing a buyer's security review looks for in a frontend.
server/src/emails/album-invite.email.tsx:43 — HTML from a variable |
server/src/emails/album-update.email.tsx:42 — HTML from a variable |
server/src/emails/welcome.email.tsx:44 — HTML from a variable |
The app allows plain HTTP to any server
adequateThe app's manifest allows unencrypted HTTP app-wide (NSAllowsArbitraryLoads, or cleartext traffic permitted), rather than for named domains. Anything sent over plain HTTP can be read on the network, and enterprise security reviews ask about it. Some apps need it by nature (a podcast or feed reader fetches whatever URL a feed gives), so ask which case this is.
mobile/android/app/src/main/AndroidManifest.xml:28 — cleartext allowed app-wide |
mobile/android/app/src/main/res/xml/network_security_config.xml:3 — cleartext allowed app-wide |
mobile/ios/Runner/Info.plist:123 — cleartext allowed app-wide |
Relicensed: MIT → AGPL-3.0 (2024-02-12)
adequateThe root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.
16 advisories against this project in the last 24 months, 7 high or critical
adequateThe newest was published on 2026-10-01. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 8 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 3.2.0. Answer lives in: the release you run, set against each fixed version.
| 2026-10-01: CVE-2026-103532 (moderate): A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the c |
| 2026-09-28: GHSA-q89f-h332-8q2h (high), fixed in v3.2.4: Authenticated SVG upload reaches ImageMagick coders and enables RCE |
| 2026-08-28: CVE-2026-82272 (high): Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessi |
| 2026-08-23: GHSA-h5w4-vjv4-9r5q (low): Incorrect sanitization of continue URL on the /maintenance endpoint |
| 2026-07-15: CVE-2026-59258 (high): immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify membe |
Observability & Operations
adequateNo structured logging library is in use
adequateNothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.
| searched 2,949 files for 10 structured logging libraries; 0 matched |
No error reporter is wired in
adequateNothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.
| no error reporter initialised |
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on immich-app/immich: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.