Security and Responsible Disclosure

The tools process your files in your browser, using JavaScript, Web Workers and WebAssembly. The site has no endpoint that accepts documents. Its only server endpoints are a health check, anonymous usage counts and feedback. The usage and feedback endpoints accept only small messages (8 KB and 4 KB at most) that match a fixed format, and they reject requests from other sites. An automated source check and browser tests guard this boundary.

Every page is sent with security headers:

• A Content Security Policy limits the page to loading code and connecting only to whyupload.com, so a page cannot send data to another site through ordinary requests. The policy does allow inline scripts and runtime code compilation, which the site relies on.
• Cross-Origin Opener and Embedder policies (COOP and COEP) isolate the page from other windows and from resources that have not agreed to be loaded.
• Other sites cannot embed the site in a frame, and no referrer is sent.
• A Permissions Policy turns off the microphone, location, payment, USB and serial features. The camera is allowed for this site only, and your browser still asks your permission first.

Local processing is only as safe as the device and browser it runs on. It cannot protect you from malware on your device, a malicious browser extension (which can read pages you open), someone watching or recording your screen, or an unsafe place you save a download. Browsers and our PDF parsers can have bugs, and a malicious file could try to exploit them. Keep your browser up to date, and be careful with files from people you do not trust.

Each time you load the site, you also trust us and Cloudflare, our host, to deliver the code unmodified. No software is free of vulnerabilities. WhyUpload has not been independently audited and holds no security certification.

If you think you have found a security problem, email support@whyupload.com with a description and the steps to reproduce it. Please use a sample file and do not send private documents. We aim to acknowledge reports promptly. We do not run a bug bounty program.

Our contact details are also published in security.txt.

Privacy questions and requests: privacy@whyupload.com

Everything else, including accessibility and security reports: support@whyupload.com