Hello everyone! I am working through an issue right now that I was hoping to get some experienced eyes on.
I am currently working on the consumer-facing side of Fineract as apart of GSoC 2026, where I ran into an issue setting/viewing client profile pictures in Fineract. The deprecated self service API actually let you set this picture yourself. The problem I am having is that I am concerned about the security implications of this. *Mainly, I am wondering if the profile picture is used for backoffice or field KYC. * For example, if a client goes to a bank, is the profile picture used as an identity verification step? If this is the case, I am leaning towards not including "write" capability on profile pictures, as this could invite potential for identity fraud. I think the ways we can proceed are: 1) Replicate the old self-service project and allow clients to change their own pictures in Fineract. This implies that it is enough that the authenticated user is the one to change their profile picture. 2) Allow "read-only" for Fineract client profile pictures on the consumer-facing side. 3) Setup a profile picture unique to the consumer-facing app. This eliminates the identity fraud issues in the backoffice. What does everyone think about this issue? -- Edward E. Kang [email protected] 972-768-6940
