A bounded path from bytes to link.
Uploads are treated as hostile input. Publication happens only after authorization, structural checks, sanitization, and a second decode.
Upload isolation
The upload gateway streams into dedicated bounded scratch space, enforces the 25 MiB limit during transfer, limits processing concurrency, and applies CPU, memory, dimension, frame, decoded-pixel, and wall-clock ceilings.
Publication
Only JPEG, PNG, WebP, and GIF are accepted. Private metadata and unsafe container data are removed. Sanitized output is decoded again, assigned a checksum, then published with restrictive response headers. Raw uploads never enter the public bucket.
Anonymous controls
Upload allowances use an HMAC of the Cloudflare client address; raw IP addresses are not stored in usage records. Deletion secrets are stored only as SHA-256 digests and remain in URL fragments so they do not enter ordinary HTTP logs.
Report a vulnerability
Send a concise report to [email protected]. Do not access other users’ data, degrade the service, or upload prohibited material while testing. A public bug-bounty program is not currently offered.