<PhatLam/>/docsVI

Operations and security

Background running, remote access, 30-day self-cleaning storage, security, health checks and regression tests.

Media StudioUpdated 21 Oct 2026
vận hànhbảo mật

Runs in the background like a Mac app

  • Open Media Studio.app (or start.command): the server runs as a macOS background service - closing Terminal, waking from sleep or a crash all restart it automatically.
  • The menu bar icon (a square frame with a play button) shows CPU temperature and RAM. Click it to open a status panel for the server and the AI engines, a grid of CPU/GPU %, RAM and temperature, links to the web app and the documentation, and a server restart. Turn off the menu bar numbers with the "Nhiệt độ & RAM trên thanh menu" (Temperature and RAM in the menu bar) item.
  • Remote restart: POST /api/admin/restart (admin).
Library: all images and videos, filters, 2K/4K downloadLibrary: all images and videos, filters, 2K/4K download
Library: all images and videos, filters, 2K/4K download

Remote access

  • Reachable over HTTPS at media.phatdev.net, with a login.
  • Public image share links look like /s/:id.

30-day storage

  • Files not viewed, downloaded or shared for 30 days are moved to private storage and deleted from the machine that runs the app; thumbnails stay, so the library still shows the image.
  • Files are deleted only after the stored copy has been confirmed directly in the archive with the correct size.
  • Opening an archived image or video pulls it back automatically (about 1 second), including when it is used in video rendering, scoring, 2K/4K export or compression.

Security

  • The entire API is fail-closed, checking the key before every content-generating route; the login gate matches paths case-insensitively.
  • Media is tied to the account that created it; other users cannot see or delete it.
  • SSRF protection and size limits when downloading images from links; config files use 0600 permissions; failed-login attempts are rate limited.
  • The AI engine can only read inside its own working folder - an untrusted web page pulled into a script cannot make the AI read configuration files.

Monitoring and testing

  • GET /api/v1/health: version, the main engine in use, how long until each engine's usage limit resets, and whether banner rendering is ready.
  • Server logs use Vietnam time; every API error is logged as [api-err] <type> <code> after Ns … so the cause can be traced.
  • Regression test (node tests/regression.mjs): 48 checks that cost no image-generation usage, run after every server change. There is also a voice-to-visual sync test for videos.