Security

Uploads are checked by signature, not just by file name. A renamed image is not treated as a PDF. Each plan has a size cap and a page cap so one request cannot consume the whole machine.

Server work runs through a small queue. The default is two jobs at a time, which you can change with MAX_CONCURRENT_JOBS. Requests are also rate limited per IP and account.

Server processing is ephemeral. Free results are returned and not kept on disk. Pro may keep a temp copy under UPLOAD_DIR for about 30 minutes for re-download, then the janitor and POST /api/cron/cleanup remove it. Scratch folders for Ghostscript/qpdf are deleted in a finally block after each job.

If CLAMAV_HOST is set, each upload is streamed to ClamAV before processing. Without it, FileNest does not claim to scan for malware. A sidecar is documented in the deployment guide.

Unlock PDF will remove a password you supply, or a permissions restriction on a file that already opens. It will not try other passwords.

Passwords for accounts are hashed with bcrypt. Stripe webhooks are verified with the signing secret. Admin actions require an admin session and a same-origin request.