Security

Security model

Upgopher shares one configured directory through HTTP. Filesystem operations validate that resolved paths stay within that directory, user paths in URLs remain encoded, and the application does not intentionally expose absolute host paths in browser-facing errors.

All application routes can be wrapped in one optional Basic Auth credential pair. This is suitable for small trusted deployments, not for multi-tenant authorization.

Network exposure

For LAN use, apply host firewall rules if the network includes untrusted devices. For remote access, prefer a private VPN or a reverse proxy with trusted TLS and additional access controls. Do not assume an obscure port provides protection.

Basic authentication

upgopher -user admin -pass 'a-long-unique-password'

Both flags are required. The credential protects the application globally and is sent by the browser on requests after login. Basic Auth requires TLS when traffic crosses an untrusted network.

Secrets supplied as command arguments may be visible to other privileged users through process inspection. Use host-level isolation appropriate for your environment.

TLS options

# Local testing; clients will show a trust warning
upgopher -ssl

# Existing trusted certificate and key
upgopher -ssl -cert /run/secrets/fullchain.pem -key /run/secrets/privkey.pem

The automatically generated certificate is self-signed, in memory, and recreated on restart. It encrypts traffic but does not establish a trusted identity. Public deployments should use a trusted certificate, commonly through a reverse proxy.

Encrypted file transfers through tunnels

upgopher -dir ./shared -encrypt-transfers -user admin -pass 'choose-a-strong-password'
# Another terminal:
cloudflared tunnel --url http://localhost:9090

Open the HTTPS tunnel URL in your browser. Upgopher encrypts file content before uploading and decrypts it at your server. Downloads are encrypted by the server and decrypted in your browser. Your existing tunnel URL and file-manager interface stay the same.

The encrypted transport covers uploads, downloads, ZIP archives, text previews, file-search excerpts, screenshots, and custom shared download links. Shared file links open a browser download page that handles decryption automatically.

Each transfer uses independent AES-256-GCM keys for uploads and responses. The browser protects those keys with the server's RSA-3072 public key using RSA-OAEP/SHA-256. The server keeps the corresponding private key in memory and generates a new one on startup. The public-key fingerprint is available in the interface and startup log.

Encryption runs in the browser with Web Crypto and in the server with the Go standard library, alongside the HTTPS connection provided by your tunnel. Files are processed in blocks, with upload progress, cancellation, and automatic cleanup of temporary transfers. Supported browsers can save downloads directly to disk.

The server saves uploaded files in their original format. Existing authentication, read-only settings, upload-size controls, and filesystem checks continue to apply. Enable the feature with -encrypt-transfers; the default transfer mode remains available when the flag is absent.

Read-only mode

upgopher -dir /srv/public -readonly

Read-only mode blocks mutating operations exposed by Upgopher. It does not modify filesystem permissions or prevent another process on the host from changing files. Defense in depth means also mounting or granting the directory read-only when practical.

State and retention

Uploaded files remain in the shared directory. Clipboard text, clipboard images, clipboard tab metadata, and custom path aliases are process memory and disappear when Upgopher restarts. Clipboard content should therefore be treated as temporary, not durable or encrypted storage.

Temporary ZIP files are created in the operating system temporary directory while downloads are assembled and are removed after serving.

Report a vulnerability

Contact @gm_eduard privately with the affected version, reproduction steps, impact, and any suggested remediation. Please do not open a public issue before coordinating disclosure.