Security

The server (backend) connects only to things you run or choose:

• Its PostgreSQL database.
• The storage you connect: your S3, R2, Wasabi, Azure Blob or other S3-compatible bucket.
• Your mail server, only if you set up email (for password reset links and sharing notices). It's optional and off by default.
• Your single sign-on provider, only if you set up OpenID Connect sign-in. It's optional and off by default.

Nothing else. There's no telemetry, no usage reporting and no update check, and license keys are verified on your server, offline. It never contacts us. The database tooling's own anonymous usage check is turned off in our images.

People's browsers connect only to your yourdrive server, plus your storage when they play a video or download a file through a signed link, and your sign-in provider when they use single sign-on. Fonts and every other asset are served by your server; nothing loads from Google or any other third party.

The installer (install.sh) downloads Docker from get.docker.com if it isn't installed, and the yourdrive images from Docker Hub. Nothing else. With automatic HTTPS it also runs Traefik, which talks to Let's Encrypt for the certificate.

One-command installs include a small updater container so admins can update from the app. It holds the Docker socket, which is root-equivalent on the host, and does exactly one thing: when the app writes an update request into a shared directory, it pulls the newest yourdrive images and restarts the stack. The internet-facing app containers never get the socket, and nothing checks for updates on its own: updates only happen when an admin asks.

• Block the internet. Run yourdrive on a network that can only reach your database and your storage (and your mail server, if you use email). It starts, applies database updates and works normally. Every release is tested this way before we publish it.
• Watch the traffic. Use your firewall's logs, tcpdump on the host, or your browser's developer tools: you'll only see your own server, database and storage.

Our release script refuses to publish an image unless all of this passes:

• The full automated test suite, against a real database and real S3 storage.
• An end-to-end test of the production images: setup, uploads, thumbnails, video playback and seeking, shared links and deletion.
• A vulnerability scan of both images (Trivy): no known high or critical vulnerabilities that have a fix available.
• An OWASP ZAP baseline security scan of the running app, with no failures.
• A start-up test with no internet access, as above.

Every image is signed, and ships with a software bill of materials (SBOM, the list of every component) and a record of how it was built. Check the signature with cosign and our public key:

cosign verify --key https://yourdriveapp.com/cosign.pub \
  yourdriveapp/backend:<version>

Read the component list, or scan an image yourself:

docker buildx imagetools inspect yourdriveapp/backend:<version> \
  --format '{{ json .SBOM }}'
trivy image yourdriveapp/backend:<version>

• Your files stay in your own bucket. We never host or see them.
• Passwords are hashed with bcrypt. Storage, email and single sign-on credentials and two-step sign-in secrets are encrypted in the database with AES-256-GCM; recovery codes are stored only as hashes.
• Two-step sign-in with any authenticator app, and single sign-on through your own OpenID Connect provider, in every plan.
• Changing or resetting a password signs out every other session. Reset links work once, expire after an hour, and only a hash of them is stored.
• Sign-in and password unlock pages are rate-limited per client.
• Photos and videos load through an HttpOnly, SameSite=Strict cookie scoped to file paths; access tokens are never put in URLs.
• Files that could run code in a browser (HTML, scripts) are always downloaded, never displayed.
• The app sends a strict Content Security Policy and other security headers.
• The backend container runs as an unprivileged user, not root.

• Put yourdrive behind HTTPS (a reverse proxy such as Caddy, Traefik or nginx) and turn on HSTS there.
• Keep your bucket private. yourdrive only needs access to its own bucket.
• Don't expose the database or the bundled storage's admin ports to the internet.
• Back up the database and your bucket. yourdrive doesn't replace backups.
• Update when new versions come out, and change only the image tag (same version on frontend and backend).

The source code isn't public. If your organization needs to review it, for example before buying Business or Enterprise, we can give your reviewer temporary read-only access under a mutual NDA. Email legal@yourdriveapp.com.

Email support@yourdriveapp.com with "Security" in the subject. Include what you found and how to reproduce it. We'll reply within 3 business days, keep you updated while we fix it, and credit you publicly if you'd like. Please give us a reasonable time to release a fix before you share details publicly, and don't access other people's data while testing.