Security

1. In scope

In scope for https://convert.alexjungean.com and the published static artifact:

• A request that leaves the browser during processing with source/derived bytes, filenames, file-linked dimensions, previews, or fingerprints.
• A third-party script, remote codec, analytics beacon, or upload path on a tool route.
• CSP, framing, or MIME-sniffing gaps that allow injection or clickjacking of this origin.
• A way for one visitor’s local object URLs or worker messages to be read by another origin.
• A published pair that silently encodes a different format than the registry.
• SVG/AVIF/animation accepted and decoded against the product contract.

2. Out of scope

• Denial of service against Netlify, DNS, or TLS in general.
• Missing security headers on a non-production draft hostname you do not need to test.
• Self-XSS, reports that require a compromised extension, or physical access to the device.
• Social engineering of the operator.
• Vulnerabilities in alexjungean.com, Netlify’s platform, or a browser vendor’s encoder, unless they become exploitable because of this site’s code.
• Theoretical issues with no practical effect on this static origin.

3. Existing protections (not a certification)

The product already documents and tests: same-origin tool-route loads, zero network during processing, CSP, `nosniff`, `X-Frame-Options: DENY`, a restrictive permissions policy, signature/MIME/decode gates, resource ceilings, and object-URL/worker cleanup. Do not report the absence of server-side file scanning as a finding; files are not sent to a server.

4. How to report

Email alex.jungean@gmail.com with subject line `File Conversion security`. Include the URL, browser, steps that stay within this policy, and the impact. Do not attach real personal photos. Use a synthetic fixture.

Please allow a reasonable time to investigate before public disclosure. The operator will acknowledge mail that is not spam and will say whether the issue is accepted.

5. Good-faith research

If you make a good-faith effort to follow this policy, avoid privacy harm to visitors, and do not disrupt the host, the operator will not pursue a civil claim against you for that research and will not refer it for criminal prosecution. This is not a waiver of law for attacks, extortion, or access to systems that are not this public website.

6. No bounty

There is no reward payment, swag programme, or Hall of Fame list. A concise thank-you in correspondence is the most you should expect.

7. Visitors

If you are a visitor and believe the site sent your file somewhere, write to the same address with the time (UTC) and what you observed. Do not send the file. See Privacy.