Security

Remove Metadata Online is built with security-first principles. Here is how we protect your files and privacy.

File Validation

Every uploaded file is validated by extension, MIME type, and magic bytes. Executable and dangerous files are always rejected.

Secure Storage

Files are stored outside the public web directory with randomly generated UUID filenames. No direct URL access is possible.

Auto-Delete

All files are automatically deleted after 5 minutes — both original uploads and processed results.

Signed Tokens

Download links use HMAC-signed tokens with 5-minute expiry. No unauthorized access to processed files.

SSRF Protection

The remote URL tool blocks private IP ranges, localhost, cloud metadata endpoints, and validates all redirects.

Rate Limiting

Processing requests are rate-limited per IP to prevent abuse. Suspicious patterns trigger additional protection.

Additional implementation details

Processing engines run with configured timeouts so a single file cannot occupy a worker indefinitely.
Archives, scripts, executables, HTML pages, and unsupported file types are rejected instead of being extracted or executed.
Remote URLs are checked before and after redirects, with private networks, localhost, cloud metadata endpoints, and oversized files blocked.
Download responses are served as attachments with private tokens, no-store cache behavior, and noindex headers.
Temporary files use random server filenames and are cleaned by automatic expiration plus the recommended Hestia cleanup cron.

Security Disclosure

If you discover a security vulnerability in Remove Metadata Online, please disclose it responsibly by contacting us directly before public disclosure.