[{"_1":2,"_209":-5,"_210":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_182":183},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":17},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_95":96,"_118":119,"_173":-5,"_174":11,"_175":17,"_176":11,"_177":-5,"_178":11,"_179":-5,"_180":181},"canonicalUrl","https://hub.docker.com/r/5iprojects/stegashield/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","5iprojects","reponame","stegashield","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_49":50,"_52":53,"_54":55,"_56":11,"_57":58,"_59":60,"_61":62,"_39":31,"_28":29,"_64":65,"_66":51,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":68,"_75":76,"_77":11,"_78":79,"_80":81,"_86":11,"_87":88,"_92":29,"_93":94},"categories",[38,43,46],{"_39":40,"_41":42},"name","Networking","slug","networking",{"_39":44,"_41":45},"Security","security",{"_39":47,"_41":48},"Machine learning & AI","machine-learning-and-ai","content_types",[51],"image","date_registered","2026-04-23T18:48:21.113978Z","description","StegaShield is an application for detecting steganographically manipulated media.","is_private","last_updated","2026-05-18T20:01:36.557393Z","last_modified","2026-05-12T16:42:06.59797Z","media_types",[63],"application/vnd.oci.image.index.v1+json","pull_count",969,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Stegashield Backend\n\nSteganography detection REST API (Rust + Axum + PyTorch). Upload an image to receive a probability score indicating whether it contains hidden steganographic content. The PyTorch model is embedded in the binary at build time, so the container has no external service dependencies.\n\n**Supported Architectures:** `linux/amd64`, `linux/arm64`\n\n---\n\n## Quick start\n\n```bash\ndocker run -d \\\n --name stegashield \\\n -p 3000:3000 \\\n -v stegashield-data:/app/data \\\n -e LICENSE_TOKEN=\"\" \\\n /stegashield-backend:\n\ncurl http://localhost:3000/health\n# {\"status\":\"ok\",\"model_loaded\":true}\n```\n\nThe container **exits immediately** if `LICENSE_TOKEN` is missing, malformed, or expired.\n\nImage page: https://hub.docker.com/r/5iprojects/stegashield\n\n---\n\n## Obtaining a license token\n\nThe container is gated by a per-user, Ed25519-signed license token verified against a public key embedded in the image. The server refuses to serve traffic if the token is missing, malformed, expired, or signed by a different key.\n\n1. Submit your email at **https://stegashield.5iprojects.com/**.\n2. You will receive the token by email.\n3. Provide the token to the container via the `LICENSE_TOKEN` environment variable.\n\nTokens may be time-limited; expired tokens must be reissued. On major image versions the embedded public key may rotate, invalidating outstanding tokens. This will be documented explicitly in the corresponding release notes.\n\n---\n\n## Configuration\n\nAll settings are provided as environment variables. Only `LICENSE_TOKEN` is required.\n\n| Variable | Required | Default | Description |\n|---|---|---|---|\n| `LICENSE_TOKEN` | **Yes** | — | Ed25519-signed license token. The server exits with status 1 if the token is missing, empty, malformed, expired, or signed by an unauthorized key. |\n| `PORT` | No | `3000` | Bind port inside the container. |\n| `DATABASE_PATH` | No | `/app/data/stegashield.db` | SQLite database file path. Keep this path under `/app/data` to ensure it is included in the mounted volume. |\n| `MAX_UPLOAD_BYTES` | No | `10485760` (10 MB) | Maximum upload size. Requests exceeding this limit return `413 Payload Too Large`. |\n| `MAX_IMAGE_DIMENSION` | No | `4000` | Maximum width or height in pixels. Images exceeding this limit return `400 Bad Request`. |\n| `ALLOWED_EXTENSIONS` | No | `png,jpg,jpeg,gif,webp,bmp,tiff,tif` | Comma-separated lowercase extensions. |\n| `INFERENCE_TIMEOUT_SECS` | No | `60` | Maximum time per inference call. Exceeding this limit returns `504 Gateway Timeout`. |\n| `CORS_ALLOWED_ORIGINS` | No | `*` | Comma-separated list of origins, or `*` for any origin. Restrict to specific origins in production deployments. |\n| `RUST_LOG` | No | `stegashield_backend=info,tower_http=info` | `tracing-subscriber` env-filter expression (for example, `debug` or `stegashield_backend=debug,tower_http=warn`). |\n\nExample with custom configuration:\n\n```bash\ndocker run -d \\\n --name stegashield \\\n -p 3000:3000 \\\n -v stegashield-data:/app/data \\\n -e LICENSE_TOKEN=\"\" \\\n -e MAX_UPLOAD_BYTES=52428800 \\\n -e MAX_IMAGE_DIMENSION=8000 \\\n -e CORS_ALLOWED_ORIGINS=\"https://app.example.com\" \\\n -e INFERENCE_TIMEOUT_SECS=120 \\\n --restart unless-stopped \\\n /stegashield-backend:\n```\n\n---\n\n## Volume and port\n\n| | |\n|---|---|\n| **Volume path** | `/app/data` — SQLite database (analysis history and original image BLOBs). Without a mounted volume, the database is recreated empty on every container restart. |\n| **Bind-mount UID** | The container runs as the non-root user `appuser` (UID `1000`). For host bind mounts, run `chown 1000:1000 ` before starting the container, or use a named volume instead. |\n| **Port** | `3000` (HTTP only — terminate TLS upstream). |\n\n---\n\n## Data handling\n\nUploaded images are stored as BLOBs in the SQLite database at `/app/data/stegashield.db`, alongside each analysis record (filename, probability, label, timestamp). The container makes no outbound network calls; no data is transmitted to external services. To remove stored data, call `DELETE /api/analyses` to clear the table, or delete the volume with `docker volume rm stegashield-data`.\n\n---\n\n## Health and readiness\n\n| Endpoint | Purpose | Status codes |\n|---|---|---|\n| `GET /health` | Liveness — returns `200` whenever the process is reachable. | `200` |\n| `GET /ready` | Readiness — returns `200` only when the model is loaded; `503` otherwise. | `200` / `503` |\n\nThe image's built-in `HEALTHCHECK` polls `/health` every 30 seconds. The service is typically ready to accept traffic within 10 seconds of container start, once the embedded model has finished loading. Configure probe `initialDelaySeconds` (or compose `start_period`) accordingly.\n\n---\n\n## API quick reference\n\n| Method | Path | Purpose |\n|---|---|---|\n| `GET` | `/health` | Liveness probe |\n| `GET` | `/ready` | Readiness probe |\n| `GET` | `/api/model/info` | Model metadata |\n| `POST` | `/api/analyze` | Multipart image upload |\n| `POST` | `/api/analyze/base64` | JSON `{ \"image\": \"\", \"filename\": \"...\" }` |\n| `GET` | `/api/analyses` | List the 50 most recent analyses |\n| `GET` | `/api/analyses/{id}` | Retrieve a single analysis |\n| `GET` | `/api/analyses/{id}/image` | Retrieve the original uploaded image bytes |\n| `DELETE` | `/api/analyses/{id}` | Delete a single analysis |\n| `DELETE` | `/api/analyses` | Delete all analyses |\n| `GET` | `/swagger-ui/` | Interactive OpenAPI documentation |\n| `GET` | `/api-docs/openapi.json` | Raw OpenAPI 3.1 specification |\n\nSmoke test:\n\n```bash\ncurl -F \"image=@photo.png\" http://localhost:3000/api/analyze\n```\n\nThe full schema is available at `http://localhost:3000/swagger-ui/`.\n\n---\n\n## Docker Compose\n\n```yaml\nservices:\n stegashield:\n image: /stegashield-backend:\n container_name: stegashield-backend\n ports:\n - \"3000:3000\"\n environment:\n - LICENSE_TOKEN=${LICENSE_TOKEN:?LICENSE_TOKEN env var is required}\n - MAX_UPLOAD_BYTES=${MAX_UPLOAD_BYTES:-10485760}\n - MAX_IMAGE_DIMENSION=${MAX_IMAGE_DIMENSION:-4000}\n - ALLOWED_EXTENSIONS=${ALLOWED_EXTENSIONS:-png,jpg,jpeg,gif,webp,bmp,tiff,tif}\n - INFERENCE_TIMEOUT_SECS=${INFERENCE_TIMEOUT_SECS:-60}\n - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-*}\n - RUST_LOG=${RUST_LOG:-stegashield_backend=info,tower_http=info}\n volumes:\n - stegashield-data:/app/data\n restart: unless-stopped\n logging:\n driver: json-file\n options:\n max-size: \"10m\"\n max-file: \"5\"\n security_opt:\n - no-new-privileges:true\n healthcheck:\n test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:3000/health\"]\n interval: 30s\n timeout: 5s\n retries: 3\n start_period: 10s\n\nvolumes:\n stegashield-data:\n```\n\nProvide `LICENSE_TOKEN` via a `.env` file alongside the compose file, and ensure that file is excluded from version control.\n\n---\n\n## Logging\n\nLogs are emitted as structured JSON to stdout. Notable events:\n\n| Event | Meaning |\n|---|---|\n| `license_activated` | License token verified successfully; startup continues. |\n| `license_invalid` | License token failed signature, expiration, or format validation; the process exits. |\n| `config_error` | A required environment variable is missing; the process exits. |\n\n---\n\n## Security\n\n- **License-gated** — the server refuses to serve traffic without a valid token verified against the embedded public key.\n- **Embedded model** — the PyTorch `.pt` weights are compiled into the binary and are not present as a separate file. Standard extraction methods such as `docker cp` cannot retrieve them.\n- **Non-root execution** — the process runs as the `appuser` account (UID `1000`); the `no-new-privileges: true` option is recommended and is included in the compose snippet above.\n- **Graceful shutdown** — the process listens for `SIGTERM`, completes in-flight requests, and then exits. For longer-running inference workloads, increase the stop grace period (for example, `--stop-timeout 30`).\n- **Input validation** — uploads are validated by file extension, magic bytes, dimensions, and byte size before reaching the model.\n\n---\n\n## Troubleshooting\n\n| Symptom | Cause | Resolution |\n|---|---|---|\n| Container exits immediately; log message: `LICENSE_TOKEN env var is required` | Token unset or empty | Set the `LICENSE_TOKEN` environment variable |\n| Container exits immediately; log message: `license_invalid` | Token is malformed, expired, or signed by an unauthorized key | Request a new token from the licensing form |\n| `GET /ready` returns `503` indefinitely | Model failed to load (rare; the model is embedded in the binary) | Inspect container logs for inference initialization errors |\n| `413 Payload Too Large` on upload | Upload size exceeds `MAX_UPLOAD_BYTES` | Increase `MAX_UPLOAD_BYTES` |\n| `400 Bad Request` with `image too large` | Image dimensions exceed `MAX_IMAGE_DIMENSION` | Increase `MAX_IMAGE_DIMENSION` |\n| `400 Bad Request` with `unsupported extension` | Extension not in `ALLOWED_EXTENSIONS` | Add the extension (lowercase, without a leading dot) |\n| `504 Gateway Timeout` | Inference exceeded `INFERENCE_TIMEOUT_SECS` | Increase the timeout or reduce the input image size |\n| Browser CORS error | Origin not listed in `CORS_ALLOWED_ORIGINS` | Add the origin to `CORS_ALLOWED_ORIGINS` |\n| Analysis history lost after restart | `/app/data` not on a persistent volume | Mount `-v stegashield-data:/app/data` |\n| Bind-mount writes fail with `permission denied` | Host directory not writable by UID `1000` | Run `chown 1000:1000 `, or use a named volume |\n\n---\n\n# Proprietary Software License\n\nCopyright (c) 2026 Five Insights, LLC. All Rights Reserved.\n\n## 1. License Grant\n\nPermission is granted to individuals and organizations (\"User\") to use this software project (\"Software\") solely through authorized access methods provided by Five Insights, LLC, including authentication tokens issued via email.\n\nThis license does not grant ownership of the Software or any intellectual property rights associated with it.\n\n## 2. Restrictions\n\nUsers may not:\n\n- Copy, redistribute, sublicense, sell, lease, or commercially exploit the Software without prior written permission from Five Insights, LLC\n- Modify, reverse engineer, decompile, disassemble, or create derivative works based on the Software\n- Remove or alter any copyright, trademark, or proprietary notices\n- Share or transfer authentication tokens to unauthorized parties\n- Use the Software for unlawful purposes\n\nAll rights not expressly granted are reserved by Five Insights, LLC.\n\n## 3. Authentication Access\n\nAccess to the Software may require a valid authentication token provided by Five Insights, LLC through email or other approved communication methods.\n\nFive Insights, LLC reserves the right to revoke, suspend, or limit access at any time for any reason without notice.\n\n## 4. Ownership\n\nThe Software and all associated intellectual property rights remain the exclusive property of Five Insights, LLC.\n\nThis license does not transfer any ownership rights to the User.\n\n## 5. Disclaimer of Warranty\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND \"AS AVAILABLE\" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.\n\nFIVE INSIGHTS, LLC DOES NOT WARRANT THAT THE SOFTWARE WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR FREE OF DEFECTS.\n\n## 6. Limitation of Liability\n\nTO THE MAXIMUM EXTENT PERMITTED BY LAW, FIVE INSIGHTS, LLC, ITS AFFILIATES, OWNERS, EMPLOYEES, AND CONTRIBUTORS SHALL NOT BE LIABLE FOR ANY DAMAGES, CLAIMS, LOSSES, OR LIABILITIES ARISING FROM OR RELATED TO:\n\n- USE OR INABILITY TO USE THE SOFTWARE\n- SOFTWARE FAILURES, BUGS, OR ERRORS\n- DATA LOSS OR SECURITY INCIDENTS\n- BUSINESS INTERRUPTION\n- THIRD-PARTY MISUSE\n- ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES\n\nUSE OF THE SOFTWARE IS ENTIRELY AT THE USER'S OWN RISK.\n\n## 7. Termination\n\nThis license automatically terminates if the User violates any provision of this agreement.\n\nUpon termination, the User must cease all use of the Software and destroy any copies or access credentials in their possession.\n\n## 8. Governing Law\n\nThis license shall be governed by and construed in accordance with the laws of the State of Texas, United States, without regard to conflict of law principles.\n\n## 9. Contact\n\nFor licensing inquiries or authorization requests, contact:\n\njude@fiveinsights.com\n\n----\n\nCopyright © 2026 Five Insights. All rights reserved.\n","has_starred","hub_user","jcanady150","immutable_tags_settings",{"_82":11,"_83":84},"enabled","rules",[85],".*","is_automated","permissions",{"_89":17,"_90":11,"_91":11},"read","write","admin","user","storage_size",1456121624,"orgData",{"_97":98,"_99":100,"_101":102,"_103":29,"_104":105,"_106":107,"_108":105,"_109":110,"_111":112,"_113":114,"_115":114,"_116":114,"_117":17},"id","7ef87c40eaa645188a59fcf8c46a870e","uuid","7ef87c40-eaa6-4518-8a59-fcf8c46a870e","type","organization","orgname","full_name","5i Projects","location","Austin, TX","company","profile_url","https://www.5iprojects.com","date_joined","2026-04-01T18:58:49.146785Z","gravatar_url","","gravatar_email","badge","is_active","recentTags",[120],{"_121":51,"_122":123,"_124":125,"_126":127,"_97":128,"_129":130,"_57":162,"_163":123,"_164":79,"_165":63,"_39":166,"_167":168,"_169":137,"_170":162,"_171":72,"_172":17},"content_type","creator",34680412,"digest","sha256:64a6a378550f479c572c689bdb0af284cd81971e591a72077a6e74f7a97ea0e5","full_size",386837436,1161787478,"images",[131,146,152,158],{"_132":133,"_124":134,"_135":114,"_136":137,"_138":139,"_140":141,"_142":114,"_143":-5,"_144":127,"_69":72,"_145":-5},"architecture","amd64","sha256:80d42557048c4cc1707a5d4ffe40dadee6b16aecc6812f0d23328def7f40d3bf","features","last_pulled","2026-09-29T05:07:38.794522605Z","last_pushed","2026-05-18T20:01:33.624585775Z","os","linux","os_features","os_version","size","variant",{"_132":147,"_124":148,"_135":114,"_136":149,"_138":150,"_140":141,"_142":114,"_143":-5,"_144":151,"_69":72,"_145":-5},"arm64","sha256:5a8a63514785920aaa4afd7125ceaf25793dd3375526fccab61a2c774379949f","2026-09-28T20:34:12.216019416Z","2026-05-18T20:01:33.080913038Z",346821135,{"_132":153,"_124":154,"_135":114,"_136":155,"_138":156,"_140":153,"_142":114,"_143":-5,"_144":157,"_69":72,"_145":-5},"unknown","sha256:badb3b3e4f80ac2510edb09d88b948fa13b84a68ec57290c31fc574e467b28ca","2026-09-28T20:34:12.184270444Z","2026-05-18T20:01:32.682912307Z",1343,{"_132":153,"_124":159,"_135":114,"_136":160,"_138":161,"_140":153,"_142":114,"_143":-5,"_144":157,"_69":72,"_145":-5},"sha256:815c75a4065045eb17484145fd8a8338ae65b963e55474647f84f460ae8718d5","2026-09-28T20:34:12.172438356Z","2026-05-18T20:01:34.292553258Z","2026-05-18T20:01:35.061839Z","last_updater","last_updater_username","media_type","latest","repository",30890929,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":184,"_194":195,"_180":207,"_208":11},{"_36":185,"_49":189,"_52":53,"_54":55,"_56":11,"_57":58,"_59":60,"_61":190,"_39":31,"_28":29,"_64":65,"_66":51,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":68,"_75":76,"_77":11,"_78":79,"_80":191,"_86":11,"_87":193,"_92":29,"_93":94},[186,187,188],{"_39":40,"_41":42},{"_39":44,"_41":45},{"_39":47,"_41":48},[51],[63],{"_82":11,"_83":192},[85],{"_89":17,"_90":11,"_91":11},"tags",{"_196":70,"_197":-5,"_198":-5,"_199":200},"count","next","previous","results",[201],{"_121":51,"_122":123,"_124":125,"_126":127,"_97":128,"_129":202,"_57":162,"_163":123,"_164":79,"_165":63,"_39":166,"_167":168,"_169":137,"_170":162,"_171":72,"_172":17},[203,204,205,206],{"_132":133,"_124":134,"_135":114,"_136":137,"_138":139,"_140":141,"_142":114,"_143":-5,"_144":127,"_69":72,"_145":-5},{"_132":147,"_124":148,"_135":114,"_136":149,"_138":150,"_140":141,"_142":114,"_143":-5,"_144":151,"_69":72,"_145":-5},{"_132":153,"_124":154,"_135":114,"_136":155,"_138":156,"_140":153,"_142":114,"_143":-5,"_144":157,"_69":72,"_145":-5},{"_132":153,"_124":159,"_135":114,"_136":160,"_138":161,"_140":153,"_142":114,"_143":-5,"_144":157,"_69":72,"_145":-5},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
80d42557048c	linux/amd64	368.92 MB
5a8a63514785	linux/arm64	330.75 MB

5iprojects/stegashield

Tags for 5iprojects/stegashield