Security

We hold as little as we can, protect what we hold, and keep your keys and captures yours. This page describes the measures in plain words. Some operational detail is left out on purpose, because precision there mostly helps attackers.

• No readable passwords. You sign in with Google, or with an email address and a password. A password is stored only as a bcrypt hash, which can’t be turned back into the password. An account that only uses Google has no password at all.
• An email address has to be confirmed before it can sign in with a password. Confirmation and password-reset links expire after one hour, and we keep them only as keyed hashes, so a copy of our database can’t confirm an address or reset a password.
• Wrong passwords are limited for each account and for each network, and so are the emails that signing in sends. Passwords can’t be guessed at speed, and nobody can be flooded with our emails.
• Sessions live in an encrypted, signed cookie that scripts can’t read and that is only sent over HTTPS. A session lasts 30 days. See the Cookie Policy for each cookie.

• A key is shown once, when you create it. We keep only a SHA-256 hash of it, with its first characters and last four so you can tell your keys apart. Nobody here can read a key back.
• Revoke a key on the API keys page, and it stops working straight away. Create a new one first if something still uses it.
• Send your key in the X-API-Key header. A key put in a URL can end up in browser history and in the logs of servers along the way. Our own logs blank out keys, signatures and download links.
• To show screenshots in a web page without exposing a key, use signed requests: each URL carries an HMAC-SHA256 signature made with a signing secret for that key, and the key itself never appears. A signed URL can repeat its own capture and nothing else, so share it as you would any link.
• Requests per minute and screenshots per month are limited for each account, by plan. That caps what a leaked key can spend before you revoke it.

• Pages open in a headless Chrome on our servers, which reaches the internet only through a filter. Every connection it makes goes through that filter: the page, its redirects, and everything the page loads, frames, scripts and WebSockets included. The filter refuses private, loopback and link-local addresses, cloud metadata addresses included. It looks names up itself and connects to the address it checked, so a DNS answer that changes in between can’t get around it.
• Every capture runs in a browser session of its own, like a fresh private window. It starts with no cookies, logins or saved data, and nothing it leaves behind can reach another capture. The session is deleted as soon as the capture is done.
• Custom JavaScript and CSS are available only on the Scale plan, and clicking or hiding elements only from Pro. Scripts run inside the page being captured, with the browser’s usual protections on, so they can’t read other sites.

• Captures are kept in private Google Cloud Storage, which Google encrypts at rest. Nothing there is public or listed.
• Download links are signed and expire. Screenshots and batch files made through the API are deleted 30 days after they were made. The Privacy Policy lists how long everything else is kept.
• Ask for base64 in the response and the image comes back inside the response instead of going to storage. It may stay in our short-term cache for an hour, or for as long as you set with cacheTtl (up to 24 hours), unless you send cache: false.

Give a webhook secret, and every delivery carries an X-Webhook-Signature: sha256=… header: an HMAC-SHA256 of the request body made with your secret. Check it before you trust a delivery. A delivery is tried up to three times, with a 10-second timeout each time. Webhook addresses have to be public: we check them when you set them, and again on the connection each time we deliver.

• Payments run on Stripe, a PCI DSS Level 1 certified provider. You type your card details into Stripe’s own secure form inside our checkout, so they never reach our servers.
• We keep only Stripe’s references to you and your subscription, your plan and its renewal date.
• Every message from Stripe is checked against its signature before anything changes.
• Stripe’s script loads only when you open checkout, not when you visit the site.

• HTTPS everywhere: plain HTTP is redirected, and API responses tell browsers to use HTTPS only and carry a strict content security policy.
• Our servers are in the United Kingdom. The database and the cache can’t be reached from the internet, and the API runs without administrator rights.
• Secrets are kept in server configuration files with restricted permissions, never in code or in the code repository.
• The free tools limit each visitor by IP address, and those counters expire within a day of the last capture. Server logs, which record IP addresses too, are rotated and overwritten. Details are in the Privacy Policy.

Found a vulnerability? Tell us at contact@screenshotforweb.com, with enough detail to reproduce it. We acknowledge reports quickly, keep you informed, and credit researchers who want credit once a fix ships.

Please research in good faith: don’t access other people’s data, don’t degrade the service, don’t use our capture service to reach systems you aren’t allowed to test, and don’t keep or share data you come across. We won’t take action against good-faith research within these bounds. There is no paid bounty programme.

Security questions that aren’t vulnerability reports are welcome at the same address, contact@screenshotforweb.com. HYDRANODE LTD runs Screenshot for Web from the United Kingdom.