Security

UNBG processes images in your browser. The image-processing tool does not upload your images, masks, results or filenames, and there are no accounts or image-processing server. Usage statistics include aggregate totals plus temporary random event codes and receipt times for duplicate checks, described on the privacy page. These contain no images, filenames or account details. Google Analytics counts visits and page views, and when an upload, a sample or a download starts, and never receives images or filenames. Support emails and hosting logs are separate, as explained on that page.

This page explains the other protections, what they don't cover, and how to report a problem.

What the design rules out

  • No uploads. The image-processing tool does not send images, masks, results or filenames. Automated tests check for image data in network requests during tested processing and download flows.
  • No stored images. Nothing you process is written to browser storage.
  • No accounts or passwords. There is nothing to leak or reuse.
  • No image links. UNBG only accepts files from your device. It never fetches images from web addresses.

Browser protections

Every page is sent with strict security headers: scripts can only come from unbg.me, the site can't be embedded in other pages, HTTPS is always used, and features UNBG doesn't need (camera, microphone, location) are switched off.

Safe handling of image files

  • Files are identified by their contents, not by their name or extension. Only still JPG, PNG and WebP images are accepted. SVG, which can contain scripts, is rejected.
  • Size limits (50 MB and 60 megapixels) protect your browser from "decompression bomb" images that expand to enormous sizes.
  • Filenames are cleaned before they are displayed or used in downloads, so an odd filename can't inject code or create unexpected paths inside a ZIP.
  • Heavy work runs in a separate Web Worker, isolated from the page.

Checked files, careful updates

The app checks its own files before using them, so a damaged or tampered download is rejected rather than run. Automated tests cover privacy and security checks in tested flows.

What we can't protect against

  • Your device and browser. If your device, browser or a browser extension is compromised, it may be able to see anything on your screen, including your images. Only install extensions you trust.
  • Shared computers. Downloaded results are saved in your normal downloads folder, where other users of the same computer may see them.
  • Copies you make. Once you download or share a result, it is outside UNBG's control.

Report a vulnerability

If you think you've found a security problem, please email admin@unbg.me with the steps to reproduce it. Please don't include private images. Our contact details are also published in security.txt.

  • We aim to acknowledge reports within 7 working days.
  • Please give us reasonable time to fix an issue before disclosing it publicly.
  • We won't take legal action against good-faith research that respects this page, avoids harming other users and doesn't degrade the service.
  • There is currently no paid bug bounty.