Security

Last updated: 25 August 2026

Architecture

Convertiva is a static web application: there is no server-side file handling, no upload endpoint, and no database of user content. This removes entire classes of risk — there are no stored files to breach.

Hardening measures

File types are verified by content (magic bytes), not just extension, and mismatches are surfaced to you. SVG files containing scripts are rejected before rendering. Archive extraction neutralizes path-traversal entries and rejects decompression bombs. Per-tool file size limits and processing safeguards protect your browser from resource exhaustion. The site ships strict security headers including a Content Security Policy.

Reporting

If you discover a vulnerability, please report it to contact@convertiva.io. We appreciate responsible disclosure.