Skip to content
ScanMaster
Back to home

Legal

Security

The strongest security control on this site is architectural: your documents are never sent anywhere, so the attack surface that worries people about online converters — files at rest on a server — does not exist here.

1. Threat model, stated plainly

An online PDF site typically has: an upload endpoint, temporary object storage, a conversion worker, a queue, a database of jobs and a deletion cron. Each link is a place your document exists outside your machine. ScanMaster removes the chain. What remains is a static JavaScript bundle plus your own browser, so the realistic risks are the ones your browser already faces when opening any local file.

2. Input validation before anything is processed

Nothing is trusted from a filename. Each selected file is checked in this order:

  1. Emptiness — a zero-byte file is rejected with its name in the message, not passed to an engine that would fail confusingly.
  2. Size — 100 MB per file, 50 files per batch. This is a browser-memory guard: it stops a tab being OOM-killed mid-job, which is the most common real-world “crash”.
  3. Extension — the tool's declared accept list is enforced before a read begins.
  4. Signature cross-check — the first 16 bytes are sniffed for the real format magic (%PDF, JPEG FF D8 FF, PNG, RIFF/WEBP, GIF, BMP, TIFF, ISO-BMFF HEIC/AVIF, ICO). A file whose content contradicts its extension is refused, which is what stops a disguised binary being fed to an image decoder.

Parsing itself happens inside library parsers (pdf-lib, PDF.js) that are sandboxed to your tab: an unparseable PDF throws an error you can read; it cannot touch your disk.

3. Content and script safety

  • Files are read through the File/Blob APIs into object URLs that are revoked as soon as the job ends — no file is left mounted in the page.
  • HTML you paste or upload is converted to plain text before being laid out into a PDF; HTML from a document is never injected into this page's DOM, so it cannot execute as script.
  • SVG is rasterised through the browser's image decoder rather than inserted inline, which drops any script inside the drawing.
  • The only inline script on the site is the two-line theme bootstrap that runs before paint.

4. PDFs that arrive hostile

A PDF can carry embedded JavaScript, attachments, hidden layers and stale metadata. Two tools exist to clean a document before you forward it:

  • Sanitize PDF — removes annotations, embedded files, document-level JavaScript actions and metadata.
  • Redact PDF — permanently rasterises the pages you mark, destroying the content underneath rather than painting a removable black box over it.
  • Remove PDF Metadata — strips author, title, producer and dates.

Use them in that order for a document you are about to circulate. Note the honest limits: deep content-stream auditing needs server tooling, and redacted pages lose selectable text.

5. Password and encryption tools

Encryption, decryption and permission changes happen in your tab with a key derived from the password you type. Passwords are never logged, never placed in a URL, and never written to storage. Generate Secure Password produces randomness from the WebCrypto API (crypto.getRandomValues), not Math.random.

6. Supply chain

Dependencies are pinned by package-lock.json and bundled at build time; nothing is fetched from a CDN at runtime except OCR language data, which is loaded on demand from a recognised CDN and clearly labelled on the OCR tools. No third-party JavaScript runs on page load.

7. Diagnosing a failure yourself

Because the work is local, an error you see is a real error in your browser, not an opaque server status. Open DevTools (F12) → Console, reproduce the job, and read the message — out-of-memory and unsupported-font cases say so directly. That console line is the single most useful thing you can send us.

8. Reporting a vulnerability

Email support@scanmaster.site with “Security” in the subject. Please send a description and a proof-of-concept against the page, not a real document. We aim to acknowledge within a few working days and to patch or disable the affected engine rather than leave it exposed.

9. What we cannot promise

No antivirus or DLP on your own machine can be bypassed by us, and no browser tool can certify a document as malware-free. If a file already looks suspicious, do not open it — in your browser or anywhere else. And if your organisation's policy requires documents to be processed on approved infrastructure, local browser processing may itself need approval: this page is the summary to hand whoever decides.