Security

File handling

Every upload passes through layered validation before it is accepted.

• The file extension, the declared content type and the actual magic bytes must all agree.
• Executable file types are refused outright, whatever they claim to be.
• Files are stored under server-generated random names, never a name you supply.
• Uploaded files are never executed, and are isolated from generated results.
• Everything is deleted automatically once its retention window ends.

Downloads

Results are reachable only through a signed, expiring token that is bound to the account that created it. Physical file paths are never exposed, and a token cannot be edited to reach a different file.

Accounts

Passwords are hashed with the ASP.NET Core Identity defaults and are never stored or logged in plain text. Repeated failed sign-in attempts lock an account temporarily. API keys are stored only as hashes — the plaintext is shown once, at creation, and cannot be recovered afterwards.

In transit and at rest

All traffic is served over HTTPS with HSTS enabled. The application sets strict security headers, applies rate limits per endpoint, and validates every input server-side regardless of what the browser already checked.

Reporting a vulnerability

If you believe you have found a security issue, please contact us before disclosing it publicly. We will acknowledge your report and keep you updated on the fix.