Security

DeckPeek is designed to keep owner accounts, workspace content, and public sharing paths separate. Controls are enforced on the server and backed by database constraints where practical. No online service can eliminate every risk, so this page describes what the product actually does rather than promising perfect security.

Security-sensitive features are reviewed alongside their plan limits, authorization rules, failure behavior, and deletion paths. We do not display certification badges or compliance claims that have not been independently established.

• Production requires HTTPS, a strong application secret, verified email delivery, and email verification for new accounts.
• Short-lived email codes are attempt limited and single use. The mailbox owner chooses the sign-in password only after entering a valid code.
• Authentication endpoints are rate limited, and password reset revokes existing sessions.
• Account holders can review active sessions, change their password, and sign out other sessions from the dashboard.
• Sensitive account deletion requires a current session, the account email, the current password, and explicit confirmation of workspace deletion.

Server-side membership and role checks protect workspace, document, folder, team, branding, domain, analytics, and billing operations. Workspace data is always queried in the context of an authorized account and workspace rather than trusting a workspace identifier supplied by the browser.

Invitation tokens are generated with cryptographic randomness and stored as hashes. Accepting an invitation requires a signed-in, verified account with the matching email address. Database guards prevent documents, links, folders, and analytics records from being attached to the wrong workspace.

Share URLs use long, randomly generated identifiers. Senders can revoke a link, set an expiration date, require a password, decide whether the one-click download action is shown, and create separate links for separate audiences.

Passwords are salted and derived with PBKDF2-SHA256 before storage. Successful access is represented by a signed, HttpOnly, SameSite cookie that expires after no more than twelve hours and becomes invalid when important link state changes.

Pro controls add verified viewer email, email or domain access lists, viewer-specific watermarks, screenshot deterrence, and agreement gates. These controls reduce accidental or unauthorized access; they cannot guarantee identity, confidentiality, legal enforceability, or that a recipient will never copy content.

Browser previews deliver file data to authorized recipients. Hiding the download action does not prevent a recipient from retaining or capturing content they can view.

Original files are stored in private object storage and are read through application routes that check account or share-link access. Document responses use restrictive caching, content-type, disposition, referrer, and cross-origin headers.

Upload completion applies fast full-file structural validation to standalone JPEG, PNG, and WebP images, with bounded dimensions and pixel counts. PNG validation inflates and checks scanline structure; JPEG and WebP files are fully parsed structurally rather than decoded to pixels. PDFs go through signature, bounded structural, and page-count inspection before becoming ready. These checks reject malformed or mislabeled files, but they are not a general-purpose malware scan.

DOCX, PPTX, and XLSX files are checked as bounded OOXML packages, with active and external content rejected, then converted in an isolated LibreOffice container. Only the generated, validated PDF viewer copy is delivered to recipients.

MP4, MOV, and M4V files must stay within enforced per-file safety bounds. MOV and M4V are normalized to fast-start H.264 video with optional AAC audio before delivery. Viewer playback remains at “Preparing video” during asynchronous structural and explicit-content checks. Playback unlocks only after those checks pass. Video files do not run through a general-purpose malware scanner at launch.

• Security headers restrict framing, object embedding, browser capabilities, referrer leakage, and insecure transport in production.
• Request bodies and uploads are bounded before expensive processing.
• Durable rate limits cover authentication, link access, password attempts, verification codes, visits, domain operations, and abuse reports.
• Public-link and authentication network identifiers used for rate limiting or deduplication are transformed before being used as database keys.
• A dedicated abuse flow lets viewers report a link without downloading or forwarding the suspected material.

Account holders can export account, recent authentication activity, and workspace metadata, and can initiate account deletion from the dashboard. Deletion removes account-owned authentication history, workspace records, and stored objects through an authenticated, confirmed workflow. Active legal or safety preservation obligations can delay deletion where required.

Stripe-hosted Checkout and the Stripe customer portal handle payment entry and billing management; the application stores subscription identifiers and status rather than full card details.

• Use a unique password and review active account sessions.
• Create a separate link for each audience and revoke links that are no longer needed.
• Add passwords, expiration, verification, or an access list when the content requires them.
• Keep source copies of important documents and avoid uploading content you are not authorized to share.
• Remember that watermarks and screenshot deterrence discourage copying but cannot make copying impossible.

If you believe you found a vulnerability, contact us with the affected URL or feature, the steps needed to reproduce the issue, its potential impact, and a safe way to follow up. Do not access data that is not yours, degrade the service, use automated high-volume testing, or include secrets or another person’s content in the report.

Harmful or illegal hosted material belongs in the dedicated abuse process rather than a security report.

Report a vulnerability · Report harmful content