Security

Technical summary of the security measures implemented on this platform.

Encryption and transport

• TLS 1.2+ mandatory on all connections (Cloudflare, Fly.io).
• Session cookies: httpOnly, Secure, SameSite=Lax.
• CSRF protection via a per-session derived token, validated on every mutation.

Passwords and credentials

• PBKDF2-HMAC-SHA256, 600,000 iterations, random 128-bit salt per user.
• Temporary account lockout after 5 consecutive failed attempts (15 minutes).
• No password, session token, or reset token is ever stored in plain text: all are stored as hashes.

File isolation and non-persistence

• Uploaded files are streamed; they are never written to persistent storage on the web server.
• The conversion engine (isolated Python process) deletes its temporary files in a guaranteed finally block, even on errors.
• The user's HTML is rendered in a headless browser with restricted network access (blocking private IPs and cloud metadata endpoints) to prevent SSRF attacks.

Payments

Fully delegated to Creem Payments (PCI-DSS handled by them as Merchant of Record). This server never receives or processes card numbers.

Vulnerability reporting

If you find a security issue, write to [email protected]. We respond within a maximum of 72 hours.