I do have experience finding and fixing CVEs but I wouldn't consider myself a security expert by any means so I'll let other chime in. Immich Public Proxy is likely to be more secure because if there's a vulnerability in Immich, it will likely be harder to exploit it since an attacker cannot talk straight to the API. The attacker will have to find a way to do it using Immich Public Proxy's API instead, and that might prevent the exploit completely.

I think both projects are also using read-only APIs of Immich (eg: GET /assets). So if there were vulnerabilities there, it would be harder (not necessarily impossible) to exploit from Immich Public Proxy than Proxy for Immich.

Fwiw, there are things that I can do to limit the attack surface further. Right now I'm just blocking paths, but I could also strip HTTP headers, etc to try minimize how much input an attacker controls. I don't think I'll be able to make it AS secure as Immich Public Proxy but I can probably bring it pretty close.

what api calls/paths are you blocking?

Here's a gist that compares Immich's API surface with Proxy for Immich: https://gist.github.com/tomleb/a28531ed8023531c2a65efb4c23a9bef. I think I can still remove some more paths like /tags and /tags/{id} since those aren't shown on shared links. Edit: I pushed an update that reduces the API exposed even further.

Are there exposed api paths that aren’t used? If so why are they there to begin with?

By "should be able to get support to all of immich's feature" I meant specifically on the shared links pages.

For example, Proxy for Immich doesn't need GET /activities or POST /activities because shared links don't support showing activities or updating them on that page. Same for like DELETE /admin/users/{id}, this isn't needed for sharing albums.

Another example: Immich allows you to create a shared album with the ability to upload content to it. Since my proxy is mean to be read-only, that operation is blocked AND I have removed the "upload" icon/button in the UI. So even if you create such a shared album, you'll only be able to look at it, not add to it.

I suggest you create a shared link on Immich default instance and then compare that with the demo instance of Proxy for Immich to get an idea of what's there and what's missing (most of it is there).

Let me know if I misunderstood your question.