Security

FilesHub holds API keys, credential vaults, files and passwords for the team's apps. This page says what protects them and what that means for a caller. Everything here is live from backend 2026.10.24.1 (check GET /api/version).

Stored secrets

• Encrypted at rest with a key of their own. Vault credentials, API key and token copies, passwords, verification-code keys and provider keys are encrypted with a key derived only for stored secrets. Nothing a caller can reach encrypts or decrypts with it.
• The encryption vault's stateless encrypt/decrypt routes use a different key, so a ciphertext copied out of FilesHub's database cannot be decrypted through them. Those two routes are also off for every API key until someone switches the key's encryption_vault permission on.
• API keys and access tokens are stored as HMAC hashes and compared in constant time; the plaintext copy that the owner can reveal is encrypted as above.

API keys

• An address that sends 30 invalid API keys within a minute is refused for 10 minutes (429). A valid key is never counted, so many apps behind one shared address are not slowed.
• Origin restriction protects a key shipped in a browser from being used by other websites. It does not stop a server that copies the key and sets its own Origin header, so a key that can delete or reveal anything belongs on a server, never in a browser bundle.
• Scopes are closed by default for anything that reveals or destroys: the password manager, email marketing, and on the Management plane every vault read, reveal and write, backups, other tokens and deleting a project each need their own switch.
• Something out of a key's reach answers 404, never 403, so a key cannot learn that it exists.

URLs FilesHub fetches for you

Link previews, scheduled tasks, uptime monitors, outbound webhooks and the SSL checker fetch a URL you choose. FilesHub fetches it only when:

• it is http or https (never file:, gopher: or anything else) and carries no user name or password;
• every address its host resolves to is public: never loopback, private networks (10/8, 172.16/12, 192.168/16), link-local and cloud metadata (169.254/16), carrier-grade NAT (100.64/10), IPv6 local ranges or multicast;
• the connection goes to the address that was checked, so DNS cannot change in between;
• a redirect is checked again the same way (at most 3, GET/HEAD only);
• the answer is at most 1 MB.

A refused URL answers 422 when you save it. One that becomes private later is refused when it runs.

Files and images

Files are stored outside the web root under server-generated names and downloaded as attachments, so an uploaded HTML or SVG file never runs on FilesHub's site. Image tools work only on your own project's files (another project's file id answers 404) and refuse pictures larger than 8000 × 8000 pixels.

The dashboard

• Sign-in is Google only; the address must be one Google has verified.
• Two-step sign-in is required for every admin. After Google, the dashboard asks for a 6-digit code from an authenticator app, or one of ten single-use recovery codes. Five wrong codes a minute make the admin wait.
• Every secret the dashboard shows is written to the audit log, the same as an API reveal.

Browser security headers

Every page and API answer carries Strict-Transport-Security, X-Frame-Options: DENY, a Content-Security-Policy with frame-ancestors 'none', X-Content-Type-Options: nosniff, a strict Referrer-Policy and a Permissions-Policy that turns off the camera, microphone, location and payment APIs. No FilesHub page can be shown inside another site's frame.

Reporting a problem

Found something that looks like a security problem? Write to the team through the contact page and leave out any secret values.