Security
LPIC.cc has treated security and privacy as first-class design principles from day one — not as an afterthought. Below is an overview of the safeguards we run continuously in production.
Core security measures
HTTPS everywhere
Every connection is forced to HTTPS (TLS 1.2+), with long-lived HSTS so browsers refuse any plaintext fallback. Traffic is encrypted end-to-end and cannot be read or modified by on-path attackers.
bcrypt password hashing
User-set share passwords are stored as industry-standard one-way bcrypt hashes — not even our servers can reverse them. Plaintext passwords never exist in any of our systems.
Automatic expiration
Uploaded files are retained for 30 days after the last view. Once that window lapses, the share link invalidates immediately and the file is queued for deletion — no manual cleanup needed, and expired files cannot be accessed by anyone.
Short-lived presigned upload URLs
On upload the server issues a short-lived presigned URL so the browser can push the file directly to cloud object storage. The URL expires quickly and cannot be reused, preventing unauthorized uploads.
Strict Content Security Policy
The default policy blocks every external resource and only allows the minimum necessary origins. Combined with X-Frame-Options and Referrer-Policy headers, this shrinks the XSS, clickjacking and referrer-leak surface.
Multi-tier rate limiting
Sensitive endpoints — login, upload, password verification — are protected by rate limiting that cools down the moment abuse is detected. It blocks brute-force and automation without affecting legitimate traffic.
Frictionless bot defense via Turnstile
Critical forms are gated by Cloudflare Turnstile, which uses device and behavioural signals to tell humans from bots in the background — no image puzzles, no user friction.
Masked IP logging
Full IP addresses are never persisted. Before writing to analytics or security logs, IPs are masked (e.g. 1.2.3.***); raw IPs exist only briefly in memory long enough to serve the in-flight defense decision and are then discarded, limiting blast radius if logs ever leak.
Additional safeguards
| Measure | Description |
|---|---|
| Parameterized queries | All database queries use parameterized bindings, eliminating the SQL injection class of attack at the root. |
| Input validation | API endpoints enforce schema validation (required, min, max, email, etc.). Malformed input is rejected before it ever reaches business logic. |
| CSRF protection | All state-changing requests require an independent CSRF token, with cookies marked HttpOnly + Secure + SameSite=Strict, blocking cross-site forgery at the source. |
| Strict CORS policy | Only the official origin is allowed to call the API; unauthorized cross-origin calls are rejected. |
| Cloudflare DDoS mitigation | Edge nodes automatically detect and mitigate abnormal traffic before it reaches origin servers. |
| Masked logging of sensitive fields | The logging framework masks IPs, tokens and passwords by default — even if logs ever leak, no sensitive values go with them. |
Responsible disclosure
If you think you've found a security issue with LPIC.cc, please email [email protected] privately. In return we promise:
- Acknowledge your report within 48 hours.
- No legal action against good-faith security researchers.
- Public credit on this page after the fix ships, if you want it.
To protect other users, please avoid running automated scans or load tests against production.
Last updated: April 21, 2026