Skip to content
PDF.COSMICO.DEV

Security

Last updated:

We built PDF.COSMICO.DEV assuming any file could be hostile. That's why every document that reaches the server goes through four layers of defense before any engine touches it, and then disappears.

1. Local execution in your browser whenever possible

The safest way to protect a file is not to send it. Merge, split, organize, rotate, edit, sign, page numbers, crop, AES-256 protection and many more tools run entirely on your device: the document never leaves it. Every tool shows whether it runs “In your browser”, on the server or with a hybrid engine.

2. Processing in volatile RAM

  • Files live on an in-memory disk (tmpfs) mounted with noexec,nosuid,nodev: nothing is written to persistent disks and nothing stored there can be executed.
  • Each job's folders are created with 0700 permissions, and every container has memory and process limits.
  • The server has no ports open to the internet: it's only reachable through an encrypted Cloudflare tunnel. The engines that parse files live on an isolated internal network with no internet access; the only controlled exception is Advanced OCR (PRO), which reaches Google Cloud Vision through an authenticated internal proxy.

3. Input guard, antivirus and sandboxed disarm (CDR)

  • Magic-byte guard: the file's real binary signature is checked (PDF, ZIP/OOXML, OLE2, RTF), not its extension.
  • Anti zip-bomb: compressed documents are inspected without decompressing them and rejected above 250 MB uncompressed, a 100:1 ratio or 2,500 entries.
  • ClamAV antivirus: every file is scanned in memory before processing, including before it opens in the live editor (PRO).
  • Active PDF disarm (CDR): JavaScript, open and automatic actions (/OpenAction, /AA), /Launch, embedded files, multimedia (/RichMedia) and XFA forms are removed. Output PDFs are disarmed again before delivery.
  • Office document disarm: VBA macros, ActiveX controls, embedded OLE objects, DDE fields and dangerous external relationships (remote templates, local or network paths) are removed; only public hyperlinks survive. Any XML with external entities (XXE) is rejected.
  • Sandbox: every parse of an untrusted file runs in an isolated subprocess with its own process group and a strict deadline (15 s for disarming, 60 s for conversions, 180 s for heavy jobs). If it overruns, the whole group is killed.

4. Immediate purge and automatic deletion

  • When processing finishes, the original upload (in/) and the temporary files (work/) are deleted on the spot.
  • If a file fails the security checks, the whole job is purged immediately.
  • Results (out/) expire after 60 minutes and an automatic sweep, every 5 minutes, removes them; you can also delete them instantly with “Delete from server now”.
  • Passages indexed for AI tools expire after 24 hours or when you delete the session.

Report a vulnerability

If you find a security issue, write to [email protected] with the details to reproduce it. We'll investigate it as a priority and keep you posted; please don't disclose it until it's fixed. More on how data is handled in the Privacy Policy.