Rare find

PicPeak. A photo gallery you host yourself, with no subscription fees.

github.com/PicPeak/picpeak

@PicPeak

Problem

The full read on this project is a sign-in away — what it solves, who it serves, and where it sits in the market.

Audience

The full read on this project is a sign-in away — what it solves, who it serves, and where it sits in the market.

Market

The full read on this project is a sign-in away — what it solves, who it serves, and where it sits in the market.

Pricing

The full read on this project is a sign-in away — what it solves, who it serves, and where it sits in the market.

Vaya's read on this project

Problem, audience, market, and the verdict — sign in to see it.

Updates

July 2026

Release —v3.90.0-beta.0 Jul 16
chore(main): release 3.90.0-beta.0 (#816) Jul 16
Merge pull request #806 from PicPeak/feat/oidc-sso-phase1 Jul 16
Merge remote-tracking branch 'origin/main' into feat/oidc-sso-phase1 Jul 16
Release —v3.45.1 Jul 16
Release —v3.89.0-beta.0 Jul 16
chore(main): release 3.89.0-beta.0 (#814) Jul 16
Merge pull request #813 from PicPeak/feat/harden-picpeak-restore-robu… Jul 16
Merge pull request #811 from PicPeak/fix/security-advisories-backend Jul 16
Merge pull request #808 from PicPeak/fix/docker-image-os-cves Jul 16
feat(security): harden .picpeak restore robustness — sessions, roles,… Jul 16
fix(security): harden .picpeak restore operator-preservation (GHSA-qx… Jul 16
fix(security): reject ZIP-slip entries in archive/backup restore (GHS… Jul 16
fix(security): share-login must not bypass gallery password (GHSA-9hm… Jul 16
fix(security): preserve current admin on .picpeak restore (GHSA-qxfx-… Jul 16
fix(security): sanitize chunked-upload filename (GHSA-pc72-jf53-w28j) Jul 16
Release —v3.88.1-beta.0 Jul 16
chore(main): release 3.88.1-beta.0 (#810) Jul 16
Merge pull request #807 from PicPeak/fix/settings-secret-exposure-mfa… Jul 16
chore(security): close 21 frontend image CVEs — nginx 1.30 base + apk… Jul 16
fix(security): mask backup credentials on read + unblock MFA login du… Jul 16
fix(oidc): local-credential lockout, session hydration, split-origin … Jul 16
fix(oidc): security + robustness hardening from codex review rounds 1-2 Jul 16
fix(oidc): fail clearly when no public base URL is configured Jul 16
Release —v3.88.0-beta.0 Jul 15
Release —v3.87.0-beta.0 Jul 11
Release —v3.86.0-beta.0 Jul 10
Release —v3.85.0-beta.0 Jul 10
Release —v3.84.1-beta.0 Jul 10
Release —v3.84.0-beta.0 Jul 10