Security
The security boundary for browser processing, accounts, and responsible disclosure.
Browser processing boundary
Keeping file contents in the browser reduces exposure: the application server does not receive the files selected in published tools. Processing libraries are loaded only when the relevant tool needs them.
Files Converter cannot control browser extensions, downloaded files, or software on your device. Use an updated browser and review downloads before opening them in another application.
Application security
Administrator passwords are verified using PBKDF2-SHA256 hashes. Sessions use signed, HTTP-only cookies, administrator endpoints are rate-limited, and production data is stored outside the application release directory.
Report a vulnerability
Follow the instructions in /.well-known/security.txt. Describe the affected route, impact, and reproducible steps. Do not include private file contents, access unrelated data, or disrupt the service while testing.