Security

In your browser

• Every file is checked against its real content signature — its “magic bytes” — as well as its extension, so a renamed file cannot reach a parser that does not expect it.
• The PDF renderer is configured with remote fetching, XFA and system font access disabled, and character maps and standard fonts are served from this site rather than a CDN.
• Rendering and heavy processing run off the main thread, so a malformed document degrades into an error message rather than a frozen tab.
• A strict Content Security Policy limits what the page itself is allowed to load.

On the server

The optional processing service exists only for conversions that genuinely need a document engine. When it is enabled:

• requests are rate limited per network address;
• only an allow-listed set of conversions is accepted;
• file names are sanitised and never interpolated into a shell command;
• conversion runs as an unprivileged user in a container with no network access;
• each job gets a random identifier and its own temporary directory, which is deleted when the job finishes and swept again by a periodic cleanup task;
• document contents are never logged.

Reporting a vulnerability

If you find a security problem, please email support@pdfnexly.com with enough detail to reproduce it, and give us a reasonable chance to fix it before publishing. We are grateful for the help.