Stop the image proxy serving an hour-old copy of another org's branding

Fixkamo-internal
Shipped
August 27, 2026 at 10:59 PM UTC
Author
Kamo
Commit
70b721a

Theme asset URLs are stable and say nothing about their contents: an org's simple logo is always `<alias>/img/logo.svg`. Every org is also seeded with the base theme when it is created, so between creation and its first upload those URLs legitimately serve Kamo's logo and Kamo's backgrounds. The proxy answered with `private, max-age=3600`, so a fetch in that window pinned Kamo's bytes under the org's own URL for an hour with no revalidation — and because the HTTP cache is per-profile rather than per-tab, in every other tab as well. It reads exactly like tenant data leaking between organizations, and it is not: the bytes in MinIO and the org records were correct throughout. Confirmed on the org that hit it — its logo and all five backgrounds were stored correctly under its own alias, and nothing had been written to the platform's folder at all. Now `private, no-cache`: still stored, but revalidated before reuse. The upstream ETag is passed through and the viewer's `If-None-Match` forwarded, so an unchanged image costs a 304 rather than a re-download — the same bargain the theme's CSS, config.json and background images already make.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing