We take security vulnerabilities seriously. If you discover a security issue in this project, please do not open a public GitHub issue.

Instead, report it privately by:

1. Email: Use GitHub's private vulnerability reporting feature on this repository.
2. Include in your report:
   • A description of the vulnerability
   • Steps to reproduce (proof of concept if possible)
   • Potential impact

We aim to respond within 7 days and will coordinate a fix and disclosure timeline with you.

This project implements the following security controls:

• Zero-persistence image handling: User-uploaded images are never written to disk — they exist only in Node.js process RAM with a 60-second TTL auto-purge.
• Session-based identity: Users are assigned a server-issued HttpOnly, SameSite=Lax session cookie (crypto.randomUUID()). No user-supplied identity headers are trusted.
• Ownership checks: All job endpoints (/api/jobs/[id]/stream, /api/jobs/[id]/result, /api/jobs/[id]/restart) verify the requesting session owns the job before serving any data.
• Image format validation: Uploaded files are validated at the byte level via sharp.metadata() — the client-supplied Content-Type is never trusted. Only PNG, JPEG, WebP, and AVIF are accepted.
• Input bounds: File size is capped at 25 MB. Pixel count is capped at 200 megapixels. Scale and placement values are clamped server-side. Room IDs are validated against an allowlist.
• Rate limiting: IP-based rate limiting (10 requests per 60-second window) is enforced on the upload endpoint.
• Security headers: All responses include Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Referrer-Policy, and Permissions-Policy.
• Dependency auditing: Dependencies are kept up to date and audited via npm audit.