Image-processing security
PixHandy keeps common image work inside the browser, reducing the need to transmit or retain private files.
Input and memory safeguards
Accepted types, per-file byte limits, batch totals, dimensions, pixel counts and estimated working memory are checked before large canvas allocation. Smart-tool masks, crop regions and GIF timelines are normalized to decoded image bounds, recipes are versioned and validated, stale work is cancelled, temporary resources are released, and exported names are sanitized.
Bounded document decoders
Supported TIFF and PSD inputs are inspected for signature, dimensions, color depth, compression and section bounds before a disposable local worker decodes their limited pixel subset. The PSD path reads only a compatible embedded flattened composite; it does not parse or reproduce editable layers, linked assets or Photoshop metadata. PSB and unsupported PSD variants are rejected before canvas work.
Execution boundaries
Account recipe boundary
Account recipe requests require the signed-in identity supplied by the hosting platform. Writes are same-origin, intent-marked, size-bounded and fully schema-validated; ownership is checked on every read, replacement and removal. Revisions prevent a stale device from silently overwriting a newer account library, and account responses are not cached.
Ready-job handoff safeguards
Home and Menu inspect actual image bytes, type, dimensions and the complete selection before marking a compatible tool Ready. Activation creates an opaque reservation for that exact destination. Integrity is checked again before an atomic, single-use claim and queue commit; stale, duplicate or conflicting arrivals are rejected.
Local suggestions still need review
Tap the subject runs bundled MediaPipe and MagicTouch files in a disposable same-origin worker; automatic face suggestions use the same local boundary with MediaPipe and BlazeFace. Both are fallible suggestions. Color edge, exact Keep or Remove corrections and manual blur controls remain available, and the full result must stay visible for review before download.
Safer markup boundaries
HTML capture removes scripts, event handlers, forms, frames and remote URLs. Pasted and single-file style blocks are removed, while one bounded local static HTML project (.zip) may use qualified local CSS and referenced PNG, JPG or WebP assets after ZIP, path, size and content checks. It never runs project JavaScript or recreates a live site. SVG conversion, compression and resize use a separate bounded parser whose supported subset removes all CSS style blocks and attributes, active elements, embedded images, links and external resources. PixHandy does not offer server-side arbitrary URL fetching.
Offline cache boundaries
The service worker accepts same-origin GET pages and fixed build assets only. The integrity-verified face-suggestion and Tap the subject assets can be cached only after a successful online use for later offline reuse. It rejects API, local workspace, cross-origin, blob, non-GET, private and no-store caching paths, and deletes older PixHandy shell caches during activation without touching unrelated caches. Photos and pixels, filenames, tap coordinates, masks and results are neither uploaded nor placed in the offline cache.
Report a security issue
Email security@pixhandy.com. PixHandy monitors that address and prioritizes reports according to their potential impact, but does not promise a response or resolution time. Include the affected page, a concise reproduction and the impact; do not send passwords, original images or unrelated sensitive data. Product-help requests belong at support@pixhandy.com.