SmartKit File Share Gets Stronger P2P Security and Cleanup

SmartKit File Share received a major reliability, cleanup, and security upgrade on July 30, 2026.

This update strengthens direct P2P sharing, improves expired file handling, protects share actions more carefully, and makes old or deleted links easier to understand for receivers.

Safer P2P Transfer Rooms

Direct P2P sharing now requires the sender to be logged in before creating a transfer room.

Receivers can still join instantly without creating an account. They only need the 6-digit code or the receive link to connect and start the transfer.

This keeps receiving simple while making room creation more accountable and secure.

Stronger Room and Signaling Protection

The P2P room system has been hardened across the flow.

Room creation and actions now use safer POST requests, CSRF protection, stronger random room codes, rate limiting, stricter room and session ownership checks, and protected signaling.

The system also now includes safeguards to prevent another receiver from hijacking an active transfer.

Better Browser-Side Transfer Handling

The browser-side transfer script is now more resilient.

It handles expired sessions and unexpected server responses more clearly, escapes file names safely in the interface, and keeps showing the transfer code even if the QR library fails to load.

This makes P2P sharing feel more stable, even when something goes wrong in the browser or network layer.

Automatic Cleanup for Expired Share Links

Created share links now clean up expired files automatically.

When files expire, they are removed from the server and deducted from storage usage, so the user’s quota is freed correctly.

This helps keep File Share storage accurate and prevents old expired uploads from silently occupying space.

Friendly Pages for Deleted or Expired Links

Deleted and expired share links now show a polished friendly page.

Instead of a broken or confusing error, visitors now see a clear message explaining that the file was deleted, expired, or is no longer available.

This makes old links feel intentional and understandable instead of broken.

Safer Manual Share Deletion

Manual share deletion is now safer and more complete.

When a user deletes a share, SmartKit removes the physical files and file records while keeping enough status information for old links to show the correct deleted or expired message later.

Cleanup Flow and CSRF Protection

Old expired and orphaned File Share uploads were cleaned from the live server.

The automatic background cleanup flow now handles cleanup more safely, and cleanup debug output is protected. CSRF protection has also been added to share-link upload, finalize, and delete actions.

Smart Relay Planned Next

Smart Relay has been planned as the next File Share improvement.

It will provide a server-assisted transfer mode for cases where direct P2P fails across strict networks, without permanently storing files on the server.

This update makes SmartKit File Share more secure, more reliable, and cleaner behind the scenes, while keeping the receiver experience simple and fast.