ScreenshotFreeAPI assumes that submitted URLs are hostile, output files are sensitive, and teams need scoped access. Every control in the system starts from that assumption.
Input validation, execution isolation, key management, and output protection are designed as independent, overlapping controls.
Every URL submitted to the capture engine passes through a strict SSRF blocklist before Playwright navigation. Localhost, metadata services (169.254.169.254), private ranges (10.x, 172.16–31.x, 192.168.x), and IPv6 loopbacks are all rejected at the schema-validation layer — not just in the worker.
Each screenshot job receives its own Playwright BrowserContext, created from a shared Browser pool. Cookies, storage, service workers, and any prior state are completely absent. Contexts are destroyed immediately after the capture completes — no carryover between jobs or tenants.
Raw API keys are shown exactly once at creation time and never stored again. The database holds only a bcrypt hash alongside a non-secret prefix (e.g. sfa_a3f2b1) for O(1) key lookup. Timing-safe comparison is used on every authentication check to prevent timing oracle attacks.
Screenshot files are delivered through HMAC-signed URLs (S3 presigned or local HMAC tokens) that expire on a configurable TTL. Webhook deliveries include an X-ScreenshotFree-Signature header for HMAC-SHA256 payload verification. Public bucket access is never used.
The full set of mechanisms active on every API request and capture job.
SSRF rules block localhost, metadata, and private network ranges.
Raw keys are shown once and stored with bcrypt hashes.
Every job receives its own Playwright browser context.
HMAC and presigned URLs protect screenshot delivery.
Pino logs track job state, retries, storage, and webhook delivery.
Owner, admin, member, and viewer controls prepare the app for teams.
ScreenshotFreeAPI applies strict data minimisation across the capture pipeline — no raw keys, no persistent screenshot content beyond your configured TTL.
| Data category | Retention | Protection |
|---|---|---|
| API keys | Until revoked | bcrypt hash only |
| Screenshot files | Configurable TTL | TLS + SSE at rest |
| Job records | 90 days | TLS + DB encryption |
| Webhook logs | 30 days | TLS |
| Billing events | 7 years | TLS + PCI scope |
| Structured logs | 14 days | TLS |
We are happy to walk through the threat model, review your access control requirements, or provide a completed security questionnaire.