Security
Last reviewed:
Six-layer architecture
1. Browser sandbox
PDF bytes stay in the page origin. Same-origin policy blocks other sites from reading the ArrayBuffer.
2. Web Workers
Compression runs off the main thread. The file is not posted to a remote URL.
3. WebAssembly codecs
MozJPEG and related codecs execute locally. No native plugin, no extra OS trust.
4. No document ingress
There is no upload API for PDFs. A server breach cannot leak files we never received.
5. Auth isolation
Supabase holds account data separately. Privileges are enforced by database Row Level Security and server-controlled role claims, not by a hidden URL or a browser redirect. Google Analytics measures traffic unless opted out; first-party usage logs wait for an accepted analytics choice. Neither receives an account ID from the analytics integration, and advertising cookies stay off.
6. Transport & headers
HTTPS and production security headers protect hosted assets and navigation. Report issues to security@bytespdf.com.
Threat model (honest)
- In scope for us: accidental document upload endpoints, XSS that could exfiltrate an open file, supply-chain on worker scripts.
- In scope for you: malware already on the device, a compromised browser extension, shoulder surfing, the portal you upload to after download.
- Out of scope: claiming HIPAA Business Associate status — we are not one. See the medical records page.
Report a vulnerability
Email security@bytespdf.com. Please include steps, impact, and whether document bytes could leave the origin. We do not run a public bug bounty today.