Security policy

How the site is secured

• All traffic uses HTTPS (enforced by Cloudflare Pages).
• Security headers configured in _headers:
  • X-Content-Type-Options: nosniff
  • X-Frame-Options: DENY
  • Referrer-Policy: strict-origin-when-cross-origin
  • Permissions-Policy restricts camera, microphone, geolocation.
  • Content-Security-Policy restricts scripts, styles and connections to the site itself.
  • Strict-Transport-Security with one-year max-age.
• No third-party scripts load by default. No tracking pixels, no analytics that touch subtitle content.
• The site is fully static. There is no backend, no database and no server-side code that could be exploited.
• There are no user accounts and no login, so there is no password storage or session handling to attack.
• Subtitle file content is never transmitted to the server.

XSS prevention

Subtitle content is untrusted data. The site's tools use textContent or safe DOM methods to render user-provided text, never innerHTML with subtitle content. This prevents cross-site scripting attacks through malicious subtitle files.

Reporting a vulnerability

If you find a security vulnerability, please report it privately:

• Email: security@subtitle-convert.pages.dev
• PGP key: not currently published.

Please include:

• Description of the vulnerability.
• Steps to reproduce.
• Potential impact.
• Your preferred contact method (email or anonymous).

What we will do

• Acknowledge your report within a few business days.
• Investigate and confirm.
• Fix and deploy.
• Credit you (with permission) in the changelog.

In scope

• Cross-site scripting in any tool.
• Content Security Policy bypasses.
• Injection through file inputs (the file content is never executed, but if you find a way to trigger code execution, that is a critical issue).
• Open redirects.
• Security header misconfigurations.

Out of scope

• Subtitle files that fail to parse (not a security issue).
• Large files that slow the browser (a documented limitation).
• Missing headers on non-HTML resources that are already protected by Cloudflare.
• Issues that require physical access to the user's device.
• Social engineering attacks against the site operators.
• Third-party services (Cloudflare) — report those to Cloudflare directly.

Responsible disclosure

Please give us reasonable time to fix the vulnerability before any public disclosure. We aim to fix critical issues within 7 days and others within 30 days.

No bounty

We do not currently offer a bug bounty program. We do sincerely appreciate security researchers who disclose responsibly.