Outcome. The pictures the forge takes of an app are only ever shown to someone allowed to see what they show.
Phone and desktop pictures are taken signed in as the owner. They are served only to people who can write the repository: on the picture route, on a pull's Look card, and on the app's page.
The thumb is taken as nobody. It is served to whoever may open the app: anyone for a public app, a signed-in reader for a private one. A thumb from before thumbs were taken as nobody is served to writers only until the looks sweep retakes it.
A retaken picture gets a new URL, so a browser never keeps showing a replaced one.
Done means reachable: the picture route and the pages that embed pictures. Tests with an anonymous visitor and a signed-in non-writer on a public repository that hosts a private app.
Trust umbrella #586. Related: #620.
Outcome. The pictures the forge takes of an app are only ever shown to someone allowed to see what they show.
Done means reachable: the picture route and the pages that embed pictures. Tests with an anonymous visitor and a signed-in non-writer on a public repository that hosts a private app.
Pull: #717.