37 lines
2.9 KiB
Markdown
37 lines
2.9 KiB
Markdown
# Privacy and security
|
|
|
|
## Local processing
|
|
|
|
Selected images stay in the browser. Image Tools has no analytics, telemetry, account, upload endpoint or CDN dependency. Tests fail external requests, and the release CSP restricts scripts, workers, images and connections to packaged/local resources and generated blob URLs.
|
|
|
|
## Untrusted input controls
|
|
|
|
- Supported signatures are JPEG, PNG and WebP only; a filename or browser-provided MIME type is not trusted.
|
|
- Metadata inspection reads at most a 1 MiB window; PNG and WebP animation
|
|
detection additionally read only bounded eight-byte chunk headers and skip
|
|
payloads by checked offset.
|
|
- Checked arithmetic protects marker/chunk offsets and declared dimensions.
|
|
- Sources are limited to 256 MiB each, 512 MiB per queue, 32,768 pixels per edge and 40 megapixels.
|
|
- Estimated processing memory is limited to 512 MiB.
|
|
- Recognized APNG, animated WebP and JPEG MPF/multi-picture files are refused before decode.
|
|
- Each material operation has an abort signal, disposable worker and 120-second deadline.
|
|
- A batch is sequential and retains at most 256 MiB of completed output.
|
|
- Batch ZIP assembly separately caps retained inputs at 128 MiB and output at 160 MiB, uses collision-free generated paths, and includes only already-created outputs/reports after an explicit action.
|
|
- Imported recipe JSON is capped and structurally validated; it cannot name files, fetch resources or introduce an unadvertised codec.
|
|
- Imported strings are rendered as React text, never active markup.
|
|
- Unsafe path characters and leading/trailing dots are removed from generated download names.
|
|
|
|
Header inspection is deliberately not full format validation. The browser decoder remains authoritative and may reject a file after the bounded header has passed. The UI reports this as failure, never as an empty successful result.
|
|
|
|
## Metadata and colour claims
|
|
|
|
The editor decodes to pixels and creates a new encoded file. It does not intentionally copy source EXIF, XMP, ICC, text/comments, embedded thumbnails or trailing bytes. However, it does not independently parse every possible proprietary block or re-scan exported bytes, so it must not be advertised as a verified metadata scrubber or anonymity tool.
|
|
|
|
Visible pixels can contain faces, text, locations, watermarks or steganographic data. Copies and sidecars outside the selected file are unaffected. Use a dedicated Privacy Tools audit when available.
|
|
|
|
Canvas operates on a browser-managed 8-bit representation. Arbitrary ICC profiles, HDR/wide-gamut precision, original gamma/chroma decisions and original compression are not preserved. JPEG export is lossy, and browser encoder bytes may differ across engines and versions. These limitations appear in the interface and every JSON operation report.
|
|
|
|
## Reporting vulnerabilities
|
|
|
|
Do not attach a private image to a public issue. Follow [SECURITY.md](../SECURITY.md) and provide a synthetic reproducer where possible.
|