Indexing of locked folder

[Ilosariph]

I have not tried this behaviour yet, but might be a concern to some as mediakit isn't protected with an account like immich.
Does mediakit also index the locked folder? If so it might be worth considering an option to disable indexing of the locked folder.

[RazgrizHsu]

Hi @Ilosariph,

Thanks for raising this privacy concern.

You're right that MediaKit indexes all active assets from Immich, including those in locked folders. MediaKit reads directly from the database without filtering by the visibility column (which Immich uses to mark assets as locked, archive, timeline, or hidden).

By design, MediaKit needs to scan all photos - including archived, locked, and hidden ones - because duplicate photos can exist across all visibility states. Filtering them out would reduce the effectiveness of duplicate detection.

The real concern is access control:

MediaKit doesn't have user authentication like Immich does. The security model relies on deployment:

• Network isolation: Deploy MediaKit on a trusted network
• Access control: Use firewall rules or reverse proxy with authentication
• Single-user environment: Ensure only trusted users can access the MediaKit interface

If you need to restrict access to MediaKit, consider:

1. Using a reverse proxy with authentication (e.g., nginx with basic auth)
2. Restricting access by IP address
3. Deploying MediaKit only when needed, then shutting it down

MediaKit is designed as an administrative tool for managing your Immich library, similar to database management tools - it assumes the operator has full access to all data.

[Ilosariph]

Thanks for that answer, makes perfect sense.