Security & Privacy

#Security at RedRiverLab

The site is a personal laboratory running on its own hardware. There is no account system, no sign-up, and no profile is kept about you.

Measures in place

• All traffic over HTTPS; HSTS enabled.
• Security headers: content security policy, framing protection, MIME sniffing disabled, referrer restriction, permissions policy.
• Server input is validated; file type and size are restricted.
• Rate limiting and temporary lockout for heavy request patterns.
• Every request gets a request ID used to trace errors.
• Error messages never expose stack traces to users.
• Secrets live only on the server in environment variables and are never sent to the browser.
• Temporary working files on the server are deleted as soon as the job finishes.
• The admin dashboard is protected by a password hash and two-step verification (TOTP); sessions have absolute and idle timeouts, failed attempts are locked out, and every administrator action is written to an audit log.
• Fonts and all libraries are served from our own server — no third-party CDN.

Planned (not yet in place)

• Automated dependency vulnerability scanning.

#How tools process data

Tools do not all behave the same way. There are three behaviours, and each tool states which one applies in a single sentence next to its input.

• Stays in your browser: your file never leaves your device. The audio converter, background remover, metadata reader and hardware tools work this way.
• Goes to our server: the work happens on our machine. The media downloaders and voice analysis work this way.
• Goes to an external service: a clearly named provider is used. Only voice analysis (Groq) and the GitHub auditor (GitHub API) do this.

For exact behaviour, read the short note on the tool’s own page. That sentence governs, not this general summary.

Files you upload

Files that reach the server are held only for the duration of the job and deleted when it finishes. Uploaded files are never published at a public address.

#Operational logging

A limited operational log is kept to keep the service running. Its purpose is to diagnose errors, prevent abuse, spot performance problems and improve tool reliability.

What is recorded

• Event type and timestamp
• Request ID, route and tool name
• Response status and duration
• Error category
• Approximate request size and whether a file was present
• Rate-limit state
• Server memory, application memory and uptime
• For security events: IP address, ISP/ASN, approximate country, browser and device family

What is not recorded

• Files and images you upload
• Request bodies and form contents
• Passwords, tokens, cookies, authorization headers
• Full addresses carrying tokens or private parameters
• File contents and secret settings

For security-relevant events the IP address, network provider (ISP/ASN), approximate country and browser/OS family are recorded. These are visible only in a private dashboard protected by a password and two-step verification; they are never shown anywhere public. Location and provider data is read from a local database — your address is not sent to an external lookup service — and is approximate, not an exact physical location.

Files you upload

If you upload a file to a tool, it is held for a short period in a protected area that authorized administrators may access for technical troubleshooting, abuse prevention and security investigation. The area is not public, files are encrypted on disk, and they are deleted automatically after 30 minutes. The file itself is never sent to notification channels.

Where a specific security incident, legal claim or valid authority request requires it, the relevant records may be retained for as long as necessary. That means only the records related to that incident, not everything.

Routine records are deleted automatically after seven days. Security-related records (abuse, rate-limit violations, unauthorised access attempts) are kept for at most ninety days so an incident can be investigated afterwards. Nothing is stored indefinitely and logs never leave the server.

When you reach the site your IP address technically passes through our hosting and delivery infrastructure — that is how the internet works. For ordinary page views we do not write it to our own records; for security-relevant events we do record it as described above. We do not claim that no information is processed.

#Responsible use

Use the security tools only on systems you own or are clearly authorised to test, and only for legitimate research, education or defensive work.

Prohibited

• Unauthorised access and unauthorised scanning
• Credential theft
• Malware distribution
• Denial-of-service activity
• Unlawful surveillance

Tool results are informational, are not forensic evidence, and may require manual verification.

#External services

While you browse, your browser makes no request to any third-party server. The following apply only when you use the relevant tool.

Cloudflare

Whole site — delivery and TLS. Connection data passes through the infrastructure.

Groq

Voice Autopsy — your recording and its transcript are sent for analysis.

GitHub

GitHub Auditor — the target name you enter is queried against the public API.

Hugging Face

Background Remover — only the AI model is downloaded; your image is not sent.

OpenStreetMap

Metadata Reader — map tiles load only if you press the button.

Discord

Operational notifications to the site owner. Contains no user content or identifiers.

In the media downloaders our server makes the connection to the target platform; your IP address is not exposed to them.

#Security reporting

If you find a security issue, write to [email protected]. Adding “Security” to the subject helps it get seen faster.

Useful things to include

• The affected address or component
• The type of issue and its likely impact
• Steps to reproduce
• A proof of concept, if any

Do not, while testing

• Denial-of-service or load testing
• Deleting, modifying or corrupting data
• Attempting to access other people’s data
• Establishing persistence
• Social engineering
• Public disclosure before coordination

There is no bounty programme, no safe-harbour commitment and no guaranteed response time. These are the honest limits of a one-person project.

Machine-readable information: /.well-known/security.txt

#Contact

One address for security, privacy and data requests: [email protected]

For data requests and the formal texts, see the Legal page.