Security

Passwords are hashed with PBKDF2 (SHA-256, 100,000 iterations) and a random per-user salt before storage. We never store plaintext passwords. Session tokens are cryptographically random UUIDs stored in an HttpOnly, Secure, SameSite=Strict cookie with a 30-day expiry.

OAuth sign-in (Google, etc.) uses the authorization code flow. We store only the access token and refresh token returned by the OAuth provider, encrypted at rest. We do not store your OAuth provider password.

When you connect a data source (Google Sheets, HubSpot, Salesforce, Microsoft OneDrive), the OAuth tokens are encrypted with AES-256-GCM using a key stored separately from the database, before being written to Cloudflare D1. The encryption key is injected at runtime via Cloudflare Workers Secrets and is never exposed in source code or logs.

Tokens are decrypted only at the moment the Service needs to fetch data on your behalf, and never transmitted to the client.

Uploaded files (images, CSVs, logos) are validated server-side before storage:

• Type validation: MIME type and magic-byte checks — file extension alone is not trusted.
• Size limits: individual files are capped at 10 MB; total storage per account is plan-dependent.
• Isolation: files are stored in Cloudflare R2 under a path scoped to your user ID. No cross-account access is possible through the API.
• No code execution: uploaded files are never executed or server-side rendered. PPTX generation happens via a sandboxed sidecar process.

When you provide a URL for brand extraction or data sourcing, the Service enforces:

• Allowlist of HTTP/HTTPS schemes only (no file://, gopher://, etc.)
• DNS resolution checked against private RFC-1918 ranges to block requests to internal infrastructure.
• Redirect following is limited to three hops and re-validated at each hop.
• Response size is capped to prevent memory exhaustion via large payloads.

Every response includes a strict Content-Security-Policy header. Key directives:

• default-src 'self' — no unexpected external resource loads.
• frame-ancestors 'none' — prevents clickjacking via iframe embedding.
• img-src restricted to self, data URIs, blob URLs, and our R2 storage domain.

X-Frame-Options: DENY and X-Content-Type-Options: nosniff are set on every response as belt-and-suspenders alongside the CSP.

slide-deck.io runs on Cloudflare's global network. Cloudflare provides:

• DDoS mitigation at the network edge.
• WAF rules blocking common attack patterns (SQLi, XSS, path traversal).
• Bot management on authentication endpoints.
• Automatic TLS certificate provisioning and renewal.

The AI sidecar service (PPTX rendering) runs in an isolated environment and is not directly accessible from the public internet. It communicates only with the Cloudflare Worker over an authenticated internal channel.

If you discover a security vulnerability, please report it to security@slide-deck.io before public disclosure. We will acknowledge receipt within 48 hours and work to resolve confirmed issues promptly. We do not pursue legal action against researchers who act in good faith under this policy.