Security

01The short version

Most of the security of this service comes from what it does not hold. There is no login to break into and no payment data to steal.

• No passwords are stored, because there are no accounts.
• No card or bank details are stored, because nothing is charged for.
• Documents are reachable only with a random token your browser holds in an httpOnly cookie.
• The browser never talks to the document service directly; it talks to our own proxy, which forwards only an explicit list of endpoints.
• Everything is served over HTTPS, and the cookie is marked Secure and SameSite=Lax in production.

02How a document is protected

When you save your first document, the service mints a long random owner token and stores it in a cookie. That cookie is httpOnly, so no script running on the page — ours or anyone else's — can read it. Requests carry it as a header attached on the server, never in the page.

The consequence is worth being blunt about: whoever is using your browser is you, as far as this service can tell. On a shared or public computer, delete what you made when you are done.

Clearing cookies for this site detaches you from those documents permanently. There is no email address on file to recover them with, and that is the same property that makes the service anonymous.

03What the browser can and cannot reach

The browser only ever calls our own API path. Behind it, a server-side proxy attaches the credential that identifies this application to the document service — a credential that never exists in the page, in the bundle or in any response.

That proxy forwards an explicit allowlist of endpoints and refuses everything else with a 404. Adding an endpoint to the backend does not expose it here; it takes a deliberate line of code.

The document service applies its own rate limits, and the proxy passes their headers straight back so a client can see when it is being throttled rather than guessing.

04Logos and stamps

The two images an issuer can upload are the one place a file crosses from your machine to ours, so they are the narrowest path on the site.

Uploads are raster images only — PNG, JPEG or GIF — capped at 2 MB. SVG is refused outright: it is a document format that can carry script, and it has no business being treated as a picture.

A stored image is renamed to a random identifier, and it is served back through the same proxy as everything else rather than from a public bucket address.

05What this does not protect against

A security page that only lists strengths is marketing. These are the real limits, and knowing them is what lets you decide what to put in a document.

• Anyone with access to your browser profile has access to your documents. The token is the only thing in the way.
• A document link you send to someone else is a link you have chosen to share; treat it as you would the PDF.
• This is not an archive and offers no guarantee of durability. Download anything that matters.
• We cannot restore a deleted document, a document past its 180 days, or documents belonging to a cleared browser.

06Reporting a vulnerability

Write to the address at the bottom of this page with "security" in the subject. It goes to the people who can fix it, not to a queue.

Useful things to include: what you found, the steps to reproduce it, the URL involved, and what an attacker could actually do with it. A proof of concept is welcome; a scanner report with no analysis usually is not.

We will acknowledge a genuine report, tell you what we intend to do about it, and let you know when it is fixed. There is no paid bounty programme — the service earns nothing — and we will happily credit you if you would like that.

07Good-faith research

If you are testing this in good faith and you follow the boundaries below, we will not pursue any action against you for it.

• Do not access, modify or delete documents that are not yours; use two of your own browsers instead.
• Do not run load tests, denial-of-service tests or anything that degrades the service for other people.
• Do not exfiltrate data. If you can prove access, stop there and describe it.
• Give us a reasonable window to fix an issue before you write it up publicly.