Security

Security, in plain terms

What we do to keep accounts, projects and published pages safe - and how to tell us if you find a problem.

Signing in

No passwordsYou sign in with Google, so there is no password of ours to steal, reuse or reset. Sign-in uses PKCE and a one-time state check, and refuses an address Google has not verified.
Sessions that cannot be replayedSession tokens are stored only as hashes, so a copy of our database would not sign anybody in. The cookie is HttpOnly, Secure and SameSite.
Sign out everywhere elseOne button on your account page ends every session but the one you are using.

Yours alone until publishedEvery project and every image is checked against its owner on the server, on every request. Nothing in the browser decides who owns what.
Uploads are inspectedImages are checked by their bytes, not their names. SVGs with scripts, external content or links are refused, and checked again before they are shown.
Edits cannot overwrite each otherSaves carry a revision, so a stale copy in another tab cannot silently replace newer work.

Unguessable linksA share link is long and random, and search engines are asked not to index share pages or embeds.
Embeds only where you allowEvery other page refuses to be framed. An embed is allowed only on the sites you list for that project.
Frozen and withdrawableA published version cannot change underneath a reader, and unpublishing stops the page, the embed and the images at once.

Encrypted in transitEvery connection is HTTPS, and browsers are told never to use anything else for this domain.
A strict content policyEvery page carries a Content Security Policy: scripts, styles and fonts come only from our own domain. A published picture can show images from addresses its author chose, and video only from YouTube and Vimeo.
Limits on abuseRequests are rate-limited in the application and at the network edge.
Where data livesProjects, images and accounts are stored on Cloudflare. The privacy policy names every provider and what each one holds.

Please tell us privately first, and give us a chance to fix it before you tell anyone else.

Write to security@guidedvisual.com with what you found, how to reproduce it, and what it lets somebody do.

Test only against your own account and your own projects.
Do not read, change or delete anybody else’s data, and stop as soon as you reach any.
Do not run denial-of-service tests or automated scans that put load on the service.

We will reply, keep you told as it is fixed, and credit you if you would like. There is no paid bounty programme.