Security is something you do

Like by reducing the attack surface on internal APIs?

I don’t even necessarily disagree with you, everybody has to decide themselves if this app offers enough upsides to be worth the downsides.

That being said, instantly calling OP stupid and their project crappy is just not the way to get your point across and in general considered a dick move.

Thanks for the write-up! I’ve settled on Immich but it’s always interesting to hear about other peoples perspectives.