Security

Isolation

• Every tool runs on a separate registrable domain, inside a sandboxed frame.
• The frame's Content Security Policy only allows loading its own static files and connecting to its own origin; form submissions, nested frames, plugins and base-URL changes are blocked.
• The page around the tool can receive only two kinds of message from it: the frame's height and coarse events such as "tool started". Messages are validated against a fixed schema that has no field able to carry file data.
• Processing happens in Web Workers. A crashed, cancelled or stalled worker is terminated and replaced, so one file cannot affect another.

Input validation

• File types are identified from their content signature, never from the file name alone.
• Image dimensions are read from the file header before decoding, and oversized images are rejected to prevent memory exhaustion.
• File size limits depend on the device class, and every job has a time limit.
• Settings are validated against a schema inside the worker, so tampered settings are rejected.

Reporting a vulnerability

A security contact address will be published here before launch.