Hi,
first congrats for a great app.!
I tried limiting access to the zp-core directory to my IP with htaccess in it with the allow, deny directive. Worked almost fine except for the fact that single images are not shown anymore. So I removed the htaccess.
Any chance it could work with playing with the Full image protection settings?