---
title: "Operations and security"
url: https://phatdev.net/en/docs/media-studio/van-hanh
lang: en
updated: 2026-10-20
alternate:
  vi: https://phatdev.net/docs/media-studio/van-hanh
markdown: https://phatdev.net/en/docs/media-studio/van-hanh.md
---

# Operations and security

Part of the doc set: [Media Studio](https://phatdev.net/en/docs/media-studio.md)

> Background running, remote access, 30-day self-cleaning storage, security, health checks and regression tests.

## Runs in the background like a Mac app

- Open **Media Studio.app** (or `start.command`): the server runs as a macOS background service - closing Terminal, waking from sleep or a crash all restart it automatically.
- The menu bar icon (a square frame with a play button) shows **CPU temperature and RAM**. Click it to open a status panel for the server and the AI engines, a grid of **CPU/GPU %, RAM and temperature**, links to the web app and the documentation, and a server restart. Turn off the menu bar numbers with the "Nhiệt độ & RAM trên thanh menu" (Temperature and RAM in the menu bar) item.
- Remote restart: `POST /api/admin/restart` (admin).


<div style="margin:1.6em 0"><figure style="margin:0"><a href="https://phatdev.net/uploads/p/media-studio/ui-library-vi-light-3840.webp" target="_blank" rel="noopener" class="pd-th-light" style="display:block;border:0" aria-label="Library: all images and videos, filters, 2K/4K download (4K)"><img src="https://phatdev.net/uploads/p/media-studio/ui-library-vi-light-1920.webp" srcset="/uploads/p/media-studio/ui-library-vi-light-960.webp 960w, /uploads/p/media-studio/ui-library-vi-light-1920.webp 1920w, /uploads/p/media-studio/ui-library-vi-light-3840.webp 3840w" sizes="(max-width: 900px) 100vw, 760px" width="3840" height="2160" alt="Library: all images and videos, filters, 2K/4K download" loading="lazy" decoding="async" style="width:100%;height:auto;display:block;border:1px solid var(--line);border-radius:12px"></a><a href="https://phatdev.net/uploads/p/media-studio/ui-library-vi-dark-3840.webp" target="_blank" rel="noopener" class="pd-th-dark" style="display:block;border:0" aria-label="Library: all images and videos, filters, 2K/4K download (4K)"><img src="https://phatdev.net/uploads/p/media-studio/ui-library-vi-dark-1920.webp" srcset="/uploads/p/media-studio/ui-library-vi-dark-960.webp 960w, /uploads/p/media-studio/ui-library-vi-dark-1920.webp 1920w, /uploads/p/media-studio/ui-library-vi-dark-3840.webp 3840w" sizes="(max-width: 900px) 100vw, 760px" width="3840" height="2160" alt="Library: all images and videos, filters, 2K/4K download" loading="lazy" decoding="async" style="width:100%;height:auto;display:block;border:1px solid var(--line);border-radius:12px"></a><figcaption style="margin-top:8px;font-size:13px;line-height:1.5;color:var(--muted);text-align:center">Library: all images and videos, filters, 2K/4K download</figcaption></figure></div>

## Remote access

- Reachable over HTTPS at `media.phatdev.net`, with a login.
- Public image share links look like `/s/:id`.

## 30-day storage

- Files not viewed, downloaded or shared for **30 days** are moved to private storage and deleted from the machine that runs the app; thumbnails stay, so the library still shows the image.
- Files are deleted only after the stored copy has been **confirmed directly in the archive** with the correct size.
- Opening an archived image or video **pulls it back automatically** (about 1 second), including when it is used in video rendering, scoring, 2K/4K export or compression.

## Security

- The entire API is **fail-closed**, checking the key before every content-generating route; the login gate matches paths **case-insensitively**.
- Media is tied to the account that created it; other users cannot see or delete it.
- SSRF protection and size limits when downloading images from links; config files use `0600` permissions; failed-login attempts are rate limited.
- The AI engine can only **read inside its own working folder** - an untrusted web page pulled into a script cannot make the AI read configuration files.

## Monitoring and testing

- `GET /api/v1/health`: version, the main engine in use, how long until each engine's usage limit resets, and whether banner rendering is ready.
- Server logs use Vietnam time; every API error is logged as `[api-err] <type> <code> after Ns …` so the cause can be traced.
- **Regression test** (`node tests/regression.mjs`): 48 checks that **cost no image-generation usage**, run after every server change. There is also a voice-to-visual sync test for videos.