Security practices

What the production service is built to do

A plain description of the controls in the production design. Written as requirements, not marketing — nothing here is claimed as live until it is.

What is built, and what is not. The processing service is live: uploads are validated by magic bytes rather than file extension, stored under randomised names, and returned only through signed links that expire. Converters run as unprivileged users with memory and time limits, and never see a shell. Items below marked as planned are not yet in place.

File handling

  • Never trust the file extension — validate magic bytes and MIME type
  • Randomised internal filenames; display names sanitised before shown
  • Private storage only, signed upload and download URLs, no public indexing
  • Automatic expiry plus a manual Delete now on every result

Worker isolation

  • Each processor type in its own container: pdf, office, image, media, ocr
  • CPU, memory and wall-clock limits per job
  • Archive and decompression bomb protection
  • Maximum image dimensions and page counts under fair-use rules
  • No shell interpolation — never user-supplied FFmpeg or command arguments

URL import (webpage to PDF, redirect checker)

  • Block localhost, 127.0.0.0/8, private and link-local ranges
  • Block cloud metadata endpoints and non-HTTP schemes
  • Re-check every redirect hop against the same blocklist
  • Fetch from an isolated egress with its own limits

Redaction

  • Redaction permanently removes underlying content — never a black box over selectable text
  • Affected pages are flattened or rasterised when structural removal is not possible
  • Metadata, bookmarks and attachments are checked for leaked content

Accounts and API keys

  • API tokens stored hashed, shown once at creation
  • Scopes per key; rotation with a 24-hour overlap
  • Usage records per key for the dashboard and for abuse detection

Abuse controls

  • Per-IP and per-account protection with concurrency limits
  • Dynamic resource limits and queue priority
  • CAPTCHA only when abuse signals are detected — never by default
  • Job timeouts and API rate limits

Reporting a vulnerability

The production site will publish a /.well-known/security.txt with a contact address and disclosure policy. Until then, please use the contact route on the About page.

Deliberately out of scope

OmniKitly will not include anonymous bulk email sending, address harvesting or scraping utilities. The email category is limited to inspection and validation tools — header analysis, record checks, previews — that help people understand mail they already have.