Reporting a vulnerability

How to report

Email security@pdfconversionapi.com. A useful report has:

• what you found and where: the URL or endpoint, for example POST /v2/convert/html/to/pdf
• steps to reproduce, with the smallest file that shows the problem
• the x-request-id header from the responses involved, and the time of each request in UTC
• what an attacker could do with it
• whether and how you want to be credited

We don't have a PGP key yet. If the details are sensitive, send a short first email without them and we will agree with you on a way to exchange them.

The same contact is published in machine-readable form at /.well-known/security.txt (RFC 9116), which points back to this page.

Scope

In scope:

• The API at https://api.pdfconversionapi.com: authentication, rate limits, plan limits, conversions, stored-file links (/v2/d/...) and GET /v2/usage.
• Files that make a converter do something it shouldn't when sent through our API: read files from the server, reach the network, read another account's data, write outside its work folder or run code. This includes bugs in the office suite, the browser engine and the other engines we run, when you reach them through our API.
• Files that stay within the documented limits and still exhaust a container's memory or disk, or keep a conversion running past its time limit.
• The website at pdfconversionapi.com.
• The account pages at app.pdfconversionapi.com: signing in with Google or GitHub, sessions, getting and replacing a key, and deleting an account.

Out of scope:

• Denial of service by sending a lot of traffic, and load tests.
• Social engineering, phishing or physical attacks against anyone who works with us.
• Scanner output without a demonstrated impact, and missing headers or best practices without an attack that uses them.
• Conversions that are refused because they exceed a documented limit (your plan's conversions a month, upload size and conversions at once, 120 seconds per engine run, 2,000 pages). Those are limits working as intended.
• Problems in our cloud provider's own platform (the provider is named on the subprocessor list). Report those to the provider, and tell us too if one affects our service.
• Conversion quality, such as a layout that comes out wrong. That is a bug, not a vulnerability: send it to support@pdfconversionapi.com.

Rules for testing

• Use your own API key and your own files. Get a free key by signing in at app.pdfconversionapi.com. The Free plan allows 250 conversions a month, files up to 10 MB and 1 conversion at a time.
• Stay under the rate limit of 600 conversion requests per minute, and don't run load tests.
• Don't access, change or delete anyone else's data. If you reach some by accident, stop, don't keep a copy, and tell us what you saw.
• Use test files you made or have the right to share. Never use real personal data, health records or payment card numbers.
• Give us time to fix the problem before you publish anything (see below).

What we promise

• We acknowledge your report within 3 business days.
• We tell you whether we could reproduce it and what we plan to do, and keep you updated until it is fixed.
• We tell you when the fix is live.
• If you want credit, we name you (or your handle) in the changelog entry for the fix. If you prefer, you stay anonymous.
• We agree a publication date with you. We ask you to wait until the fix is live or 90 days after your report, whichever comes first.

Safe harbor

In this policy, "we" means Zeel Shekhaliya, which runs pdfconversionapi.com.

If you make a good-faith effort to follow this policy while you research and report a vulnerability:

• we consider your research authorized, and we won't take legal action against you or report you to law enforcement because of it;
• we won't bring a claim against you under the Computer Fraud and Abuse Act or our Terms of Service for that research;
• if someone else brings a legal claim against you about research you did within this policy, we will make it known that you acted with our authorization.

This policy can't give you permission on behalf of other companies, including our cloud provider, Google and GitHub. If you're not sure whether something is allowed, ask at security@pdfconversionapi.com before you try it.

No bug bounty

We don't pay for vulnerability reports and have no bounty program. If that changes, this page will say so. What we can offer is credit in the changelog.