Security
Security Policy
How StoriesDL protects the service, and how to report a vulnerability.
A note on translations. Our legal documents are provided in English so that every visitor reads the same terms. Translations of the interface are for convenience only; the English legal text controls.
1. Our approach
StoriesDL is built around a small attack surface: a public form, a server-side extractor, signed media links, and a streaming proxy. We do not store downloaded media, we do not hold Instagram credentials, and we do not maintain user accounts.
2. Security controls
- Media download and thumbnail links are signed with short-lived HS256 tokens and bound to an allowlisted Instagram or Facebook CDN URL.
- The media proxy validates protocols, ports, hostnames, and resolved IP addresses to reduce server-side request forgery risk, and it follows redirects only within the allowlist.
- Rate limits apply to extraction, download, and contact endpoints, with optional Redis-backed shared state.
- Responses carry a nonce-based Content Security Policy, strict transport security in production, frame denial, and other hardening headers.
- Request bodies, redirect chains, response sizes, and timeouts are bounded.
- Administrative endpoints require a separate bearer token and are disabled when no token is configured.
- Optional Cloudflare Turnstile verification is available for extraction and contact forms.
- Secrets are supplied through environment variables and are never committed to the repository.
3. Reporting a vulnerability
If you believe you have found a security issue, email [email protected] with the subject line "Security report". Please include a clear description, the affected URL or endpoint, reproduction steps, and any supporting evidence. Do not include real private data or third-party personal information.
We will acknowledge a complete report as soon as practical, investigate, and keep you informed of material progress. Please give us a reasonable opportunity to fix the issue before public disclosure.
4. Scope
In scope: the application, its API routes, authentication of signed links, and server-side request handling.
- Out of scope: denial-of-service testing that degrades the service, social engineering, physical attacks, third-party services we do not control, and reports that only identify missing optional headers without a demonstrated impact.
- Do not access, modify, or exfiltrate other people's data, and do not test against content you do not own.
- Do not use automated scanners in a way that evades rate limits or disrupts availability.
5. Safe harbor
If you make a good-faith effort to comply with this policy during research, we will not pursue legal action against you for that research, and we will take steps to make clear that your research was authorized. This safe harbor does not protect intentional harm, extortion, privacy violations, or violations of third-party rights.
6. No bug bounty
We do not currently operate a paid bug bounty program. We are grateful for responsible reports and may credit researchers with their permission.
7. Contact
Security reports and other requests: [email protected].