* docs: README for general users; correct the license holder name
- Replace references to one private automation client with neutral wording
about scripts that drive ComfyUI through its API.
- Add Privacy and security (embedded workflow, key handling, dedicated key,
network scope), Compatibility and Troubleshooting sections.
- Note that a reinstall that replaces the folder does not keep .env.
- LICENSE and pyproject authors: Eric Meyer -> Eric Mey.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: refuse redirects so the API key is never sent to a second URL
urllib's default redirect handler copies ordinary headers, x-api-key
included, to the redirect target, even on another host. The private opener
now refuses every redirect before a second request is made, with an error
that tells the user to set IMMICH_URL to the final address. The README's
network-scope claim is now true.
TestRedirectsAreRefused: a cross-host redirect sends nothing to the second
host, and a same-host redirect is refused too. Against the previous module
both fail, and the key does reach the second host.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Shiori <shiori@harem.world>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
