Security

Security practices

• HTTPS transport and browser security headers.
• Private storage for uploaded project assets.
• Server-side validation of upload type, size, signature, and image dimensions.
• Rate limiting and abuse controls on public submission endpoints.
• Restricted operator endpoints protected by secret authentication.
• Encryption for stored provider credentials and secrets.
• Minimal collection and retention of customer information where practical.

Report a vulnerability

If you believe you found a security issue, email content@zillmedia.com with the subject line “Security Report.” Include the affected URL, a clear description of the issue, steps to reproduce it, and any relevant screenshots or request details.

Responsible research

• Do not access, alter, download, or delete data that does not belong to you.
• Do not disrupt service availability, send destructive payloads, or perform denial-of-service testing.
• Do not use social engineering, phishing, physical intrusion, or attacks against employees or service providers.
• Give us a reasonable opportunity to investigate and remediate a reported issue before public disclosure.

Security limitations

No website or internet service can be guaranteed to be completely immune from attack. We use layered controls, monitor the system, keep dependencies updated, and review security as the service evolves.