Security
How Stubimage handles data and how to report a vulnerability or abuse.
Transport
The site and the API are served over TLS 1.2 or 1.3 only, with HSTS. Plain HTTP requests are redirected.
Data
The service is stateless. Text from the URL is escaped before it is placed into an image, and SVG responses carry a restrictive Content Security Policy.
Abuse
Text is limited to short strings and images cannot contain links or scripts. Report abuse to abuse@assets.rooni.dev.
Reporting a vulnerability
Email security@assets.rooni.dev. We reply within two business days and do not take legal action against good-faith research. Contact details are also in security.txt.