Security at CrossUpload

Uploads are untrusted input from strangers. We designed every step on that assumption.

Separate credential classes

Dashboard login cookies, server API keys, desktop session capabilities and phone upload capabilities are distinct, with distinct permissions. Secret API keys and capability tokens are stored only as hashes and shown once.

Single-use QR pairing

The QR contains a random, short-lived pairing secret in the URL fragment. The phone exchanges it in a request body, the page clears it from the address bar and sends no referrer. After one phone pairs, the code is spent.

No tenant secrets in browsers

Your secret key stays on your server. Public project identifiers can’t authorize storage use. CORS and Origin allowlists are extra layers, never the authentication.

Private quarantine

Browsers upload directly to a private bucket with signed POST policies limited to one key, one content type, a size range and five minutes. Quarantine is never reachable through the CDN.

Independent verification

We read the stored object ourselves, check its real type from the file signature, reject HTML/SVG/executables and stream it through ClamAV with bounded resources. If scanning is down, files wait — never silently pass.

Immutable delivery

We promote the exact verified object version to a new delivery key. Replaying an old upload credential can never change an accepted file.

Private, expiring URLs

Files are delivered through short-lived signed URLs from a separate origin with nosniff and safe Content-Disposition. Encryption at rest and S3 Block Public Access are part of the production setup.

Tenant isolation

Every query that touches customer data checks account and project ownership. IDs are identifiers, not authorization.

Signed webhooks, safe destinations

Webhooks are HMAC-signed with timestamps. Outbound requests block internal, link-local and metadata addresses, pin resolved IPs, refuse redirects and bound timeouts.

Minimal data

No visitor accounts, no document contents in analytics, and secrets, signed URLs, pairing tokens and filenames are kept out of routine logs.

What we’re honest about

  • Antivirus scanning catches known threats; no scanner catches everything. Treat files as untrusted in your own processing.
  • Signed URLs can be shared while valid. Keep lifetimes short and request fresh ones on demand.
  • The reference deployment runs on a single host. It is a single point of failure and is not highly available.
  • We don’t currently hold third-party certifications such as SOC 2 or ISO 27001.

Report a vulnerability

Email master@crossupload.com with “Security report” in the subject. Please give us reasonable time to fix issues before disclosure.