Security

Handling artifacts

• Submitted content is never executed, and filenames are never passed to a shell.
• Storage keys are derived from identifiers we generate. No part of a user-supplied filename reaches a path.
• Uploaded HTML is read as text, never interpreted as markup.
• Archives are recognized and refused, not extracted. A .zip is reported as an archive that PastePile did not open, rather than being decoded as text and parsed into events that were never in it.
• Binary files in formats PastePile does not read are named as such. Nothing is invented from bytes that could not be parsed.
• Parsers run under a deadline and an event ceiling. Caught parser errors are recorded as failed parses; a worker process failure is handled separately through job leases and bounded retries.
• Every artifact is hashed with SHA-256 on ingest.

Tenancy

Case access is filtered by organization inside the same query that loads the row, so a route cannot hold a case it is not entitled to. A case belonging to another tenant returns 404 rather than 403, because 403 would confirm it exists.

Sessions and secrets

• Passwords are hashed with Argon2.
• Session tokens are stored as hashes; those stored hashes are not accepted as session credentials.
• Production sessions use Secure, HttpOnly, SameSite=lax cookies with the __Host- prefix. Existing legacy sessions migrate on their next successful authenticated request. Sessions expire after eight hours without an authenticated request by default, or at their absolute expiry, whichever comes first; deployments can configure the idle window.
• Provider API keys are sealed at rest and never returned to the browser; only the last four characters are shown.
• Artifact downloads use short-lived signed links that also require an authenticated, entitled session.

Account recovery

• New production accounts verify their email and choose a password before receiving a session. Registration acknowledgments do not disclose whether an account exists or claim email delivery.
• New invitation, reset and verification links keep tokens in URL fragments, which browsers do not send in HTTP requests. Older query links remain accepted and are cleared from the address bar; previously recorded URLs cannot be removed retroactively.
• Password reset and address verification links carry a single-use token that is stored hashed and expires. Reset links last an hour, verification links a day.
• Asking for a reset returns the same answer whether or not the address has an account.
• Resetting a password signs every session on the account out. Changing it while signed in keeps the current session and signs out the rest.
• Reset tokens are never written to logs.

Database

Database migrations enable row-level security and revoke public API roles from the application schema. Customer access is enforced by organization checks in the PastePile API; the backend database role is privileged, so row-level security is not a second tenant boundary. Authorized operators and infrastructure services also require database access.

Logging

Application logging is designed to record identifiers and operational events rather than raw evidence. Error text passes through a redactor for recognized credentials, tokens and connection strings. Redaction cannot guarantee detection of every secret format; access to operational logs must still be restricted.

What we do not claim

PastePile holds no SOC 2 report, no ISO 27001 certification, no FedRAMP authorization, no DoD Impact Level accreditation, no CMMC certification, no HIPAA business associate arrangement, and no authorization to handle Controlled Unclassified Information or classified material. Do not upload data of that kind. PastePile is not a SIEM, an EDR or a managed detection service; it does not monitor your infrastructure, is not staffed around the clock, and does not prevent breaches.

Reporting a vulnerability

Contact Andrew Young, the operator of PastePile, at security@pastepile.com, in English. Please include enough detail to reproduce the issue. We will acknowledge receipt and keep you updated while we investigate. The same address is published at /.well-known/security.txt.

In scope: pastepile.com, the application and the API behind it. Out of scope: anything hosted by our subprocessors rather than by us, which are listed on the subprocessors page and should be reported to them.

Test against your own account and your own data only. Please do not run denial-of-service or load tests, do not attempt to access another tenant's cases, and stop at the point where you have demonstrated a problem rather than proving how far it goes. If you reach another customer's data by accident, tell us and delete your copy.

We ask that you give us a reasonable opportunity to fix an issue before describing it publicly, and we will tell you when it is fixed. Good-faith research under these terms is welcome and we will not pursue you for it.

There is no bug bounty and no reward, financial or otherwise. We do not commit to a response deadline, we are not a CVE numbering authority, and we have not commissioned a penetration test. Saying so is more useful to you than a page that implies otherwise.

Last updated 2026-09-12.