Skip to main content
Platform Integrity

Security Policy

Learn about our local-first security architecture, edge infrastructure controls, and responsible disclosure program.

1. Local-First Security Architecture

The primary line of defense in SHRTX (https://shrtx.in) is architectural: we don't take your data in the first place.

Unlike conventional online conversion sites that require users to upload confidential files, images, PDFs, or source code to remote cloud servers for batch processing, SHRTX executes transformations directly within your local browser runtime using modern WebAssembly, Canvas APIs, and Web Workers. For supported client-side utilities, processing occurs in local memory rather than remote servers, substantially reducing exposure to remote network interception, server-side data leaks, and unauthorized secondary retention.

2. Edge Delivery & Static Resilience

SHRTX is deployed as a pre-rendered, highly optimized static website distributed via our global edge network. This static-first architecture dramatically minimizes common server-side vulnerability classes, avoiding risks associated with SQL injection, server-side template injection (SSTI), and dynamic application database compromise.

3. Transport Security & Content Security Policy

All communications with SHRTX require Transport Layer Security (TLS 1.3/HTTPS). We employ robust HTTP response headers to defend visitors against common web threats:

  • HSTS: Enforces HTTPS-only communication with preload directives.
  • X-Content-Type-Options: Set to nosniff to prevent MIME-type confusion attacks.
  • Referrer-Policy: Set to strict-origin-when-cross-origin to prevent sensitive URL parameters from leaking to external domains.
  • Permissions-Policy: Restricts access to sensitive browser capabilities like microphone, camera, and geolocation.

4. Minimal Third-Party Dependencies

We maintain strict control over external scripts. Third-party integrations are limited to verified, industry-standard partners: Google Analytics 4 (gated behind Google Consent Mode v2) and Google AdSense. We regularly audit and update client-side libraries to identify and remediate known vulnerabilities and maintain high security hygiene.

5. Responsible Vulnerability Disclosure Program

We welcome security researchers and ethical hackers who review our platform and report potential vulnerabilities. If you discover a security flaw or vulnerability on SHRTX, we ask that you:

  • Email full details and reproduction steps to security@shrtx.in.
  • Allow us reasonable time to investigate and mitigate the issue before public disclosure.
  • Refrain from attempting denial-of-service, automated scraping attacks, or accessing non-public infrastructure.

We will acknowledge receipt of valid vulnerability reports within 48 business hours and provide timely status updates during remediation.