Skip to content
Kiragu MainaSystems workspace
Systems onlineSend a brief
All tools

Private Gallery Access Audit

Check the paths to an original image as an anonymous, paid, unrelated, or revoked visitor using controlled test assets.

Developers building paid galleries, client proofs, and private image downloads.

Visual examples. Plain language. Go at your own pace.

Private Gallery Access Audit

Package preview. Illustrations use sample data.

Check original-image accessExample
Anonymous request for the original

200: file returned despite the blurred preview

A server error is not a passing access check.

The challengeA blur hides the preview, not necessarily the original
Illustration only. These are sample screens and values.

Slide 1 / 6

The preview is hidden. The original may not be

Your page shows a blurred image before purchase, but an export route, thumbnail, or original URL may have a different access check.

  • A visual blur is not an authorization boundary.
  • List every route that can read or deliver the asset.
1 of 6

What this means for your project

Check whether the right people can reach private images through each path you declare.

Test the file behind the preview.

Your gallery blurs unpaid photos. Test an original-image link as an anonymous visitor, a paying client, an unrelated client, and someone whose access was revoked. Use synthetic images so the test does not need a customer photo.

How would I use this with AI?

A skill is a set of instructions and examples for your AI coding assistant. You bring your idea and your project. The skill gives the assistant a process to follow.

  1. Tell your AI what you want to do and share the complete package.
  2. Work through the setup together. You may need accounts or tools listed below.
  3. Review and test the result before using it in your project.

You receive instructions and working examples to use with your own tools. Setup and review remain part of the work.

Try this as your first task
You bring
An authorized test app, synthetic images, known file hashes, and scoped test sessions.
Work toward
An access matrix and a report for the declared image paths and roles.

Check the result: Allowed paths return the known synthetic file, denied paths refuse access, and errors or redirects never count as a passing denial.

Use this after installing the package. Your AI tool and any external services are separate.

Not sure where to start? Ask about a project like yours.

Try a small example

Made-up example
  1. List readers
  2. Choose role
  3. Check response
  4. Inspect findings

Starting point

The page blurs an image; its original route is untested

What changes

Each declared role and path has an explicit expected result

Compare a denied request, a returned file, a server error, and a redirect. A broken server is not proof of protected access.

Invented teaching fixture. No files are uploaded, no payment is made, and no external app is contacted.

See how it works

Step 1 of 6

The preview is hidden. The original may not be

Your page shows a blurred image before purchase, but an export route, thumbnail, or original URL may have a different access check.

Starting situationA paid gallery shows a blurred preview
Where it breaksAn original image route can have a different access check
Made-up example. Try the interactive preview to see what changes.
  • A visual blur is not an authorization boundary.
  • List every route that can read or deliver the asset.
About this example: Checks performed on the package

Step 2 of 6

Make access expectations explicit

For each path, decide which test roles should receive the known file and which should be denied.

BeforeOnly the visible page was tested
AfterDeclared original, preview, and export paths are checked by role
Made-up example. Try the interactive preview to see what changes.
  • Include anonymous, paid, unrelated, and revoked sessions.
  • Use synthetic images so the test never needs a customer photo.
About this example: Checks performed on the package

Step 3 of 6

Probe one authorized origin

Adapt the access matrix to your test app, provide scoped session credentials through environment variables, and compare bounded GET responses with expected results.

  1. Inventory asset readers
  2. Define expected access
  3. Probe synthetic assets
  4. Review failures and repeat
Steps shown in the example.
  • Redirects are not followed. Requests have time and size limits.
  • An allowed response must match the known synthetic file hash.
About this example: Checks performed on the package

Step 4 of 6

A server error is not a passing access test

Try an anonymous request returning 403, 200, or 500. Only an expected denial supports the denial check.

What to tryCompare 403, 200, 500, and a redirect for an anonymous request
Expected resultAn expected denial passes; a returned file, error, or redirect does not
Made-up example. Try the interactive preview to see what changes.
  • A 200 response may expose the file; investigate it.
  • A 500 or redirect leaves the check unresolved, not safely denied.
Try the example
About this example: Checks performed on the package

Step 5 of 6

Review the readers and test the paths

The package pairs source review with a declared access matrix and a small probe you can inspect.

SKILL.md
Source-review and access-testing workflow
scripts/probe.mjs
Bounded one-origin GET probe
examples/plan.json
Access-plan template to adapt to your test app
docs/
Input contract and setup guidance
tests/
Six tests including a local HTTP server
What the package contains. Check the release details for the exact file list.
  • One-origin validation happens before requests begin.
  • Reports omit raw bodies and test-session secrets.
About this example: Checks performed on the package

Step 6 of 6

For a gallery you control

Run against an authorized test environment with synthetic assets and scoped accounts. Fix a finding, then repeat the affected cases.

What you need
  • Node.js 20 or later and a coding assistant
  • An app you are authorized to test, preferably an isolated test environment
  • Synthetic assets with known SHA-256 hashes and scoped test sessions
  • An explicit origin and access matrix; the supplied example URL is intentionally nonfunctional
Limits to knowOnly declared paths and roles are checked; a passing report is not whole-app certification
Check what you need and what the product can do before choosing it.
  • It checks only the paths and roles you declared.
  • It does not certify the whole app or judge image quality.
About this example: Checks performed on the package

What you receive

  • A source-review workflow for original images, previews, thumbnails, exports, and caches
  • An access matrix with expected allow and deny results
  • A bounded GET probe for one authorized origin, with redirects blocked and positive file-hash checks
  • Synthetic examples and six tests, including a local HTTP fixture
See the files in the package
SKILL.md
Source-review and access-testing workflow
scripts/probe.mjs
Bounded one-origin GET probe
examples/plan.json
Access-plan template to adapt to your test app
docs/
Input contract and setup guidance
tests/
Six tests including a local HTTP server

What you need to get started

  • Node.js 20 or later and a coding assistant
  • An app you are authorized to test, preferably an isolated test environment
  • Synthetic assets with known SHA-256 hashes and scoped test sessions
  • An explicit origin and access matrix; the supplied example URL is intentionally nonfunctional

What you can check here

Package version 1.0.0 / page version 1

  • Checks performed on the package

    Six tests passed on Node 24.20.0, macOS arm64, including local HTTP allow/deny cases, leaked-file detection, 500 and redirect failures, origin validation, and positive file-hash checks. No live customer image or external gallery was used.

Will it work with your tools?

Node 24.20.0 / macOS arm64Tested
Core checks ran after extracting the release archive into a fresh directory. Node 20 or later is required; other runtime versions and external integrations need checking in your setup.

Before you choose

Read the paid skill terms for permitted use, what your purchase includes, help, and refunds.

  • One purchase covers unlimited own and client projects for one purchaser. You may modify the package and use it with your coding AI. Do not resell or publicly redistribute the standalone package. Later versions may be sold separately. See the paid skill terms for help and refunds.
  • Use an app you are authorized to test, synthetic assets, and scoped test sessions. The example URL is deliberately nonfunctional.
  • This checks declared paths and roles. It is not a universal security scanner, an image-quality test, or proof that every private asset is protected.
Can I point it at any gallery?

No. Use only an app you are authorized to test. Supply synthetic assets and narrowly scoped test sessions.

Does a clean report mean the app is secure?

No. It checks the declared routes and roles. Undeclared paths, other vulnerabilities, and wider security review remain outside its scope.