BG Remove logo BG Remove

Security

Last updated: January 2025

The security and privacy of your data are important to us. This page describes how we protect your information and how you can report vulnerabilities.

1. HTTPS everywhere

All traffic to BG Remove is encrypted with TLS. We enforce HSTS (HTTP Strict Transport Security) to prevent protocol downgrade attacks, and we do not serve the site over plain HTTP.

2. Security headers

We apply the following HTTP response headers via Cloudflare Pages:

  • Strict-Transport-Security — forces HTTPS for a year
  • X-Content-Type-Options: nosniff — prevents MIME-type sniffing
  • X-Frame-Options: SAMEORIGIN — prevents clickjacking
  • Referrer-Policy: strict-origin-when-cross-origin — limits referrer leakage
  • Permissions-Policy — restricts camera, microphone, and geolocation

3. Data minimization

We collect only what is necessary to operate the service:

  • Images uploaded to the background remover are processed and discarded. They are not stored after the response is returned.
  • Browser-based tools never upload your images at all.
  • We do not use third-party tracking scripts beyond the disclosed analytics.

4. No API keys in client code

All server-side secrets (processing API keys, admin credentials) are kept on the server. Nothing sensitive is exposed in frontend JavaScript or HTML. The frontend only calls the public API endpoints necessary for the tools to function.

5. Input validation

Both the frontend and the backend validate uploaded files: file type, file size, and structural integrity. Frontend validation is a usability feature; backend validation is the security boundary and rejects malformed or malicious payloads.

6. Rate limiting

We apply rate limits on the processing API to prevent abuse and to protect availability for other users. Excessive or automated requests are throttled or blocked.

7. Reporting a vulnerability

If you believe you have discovered a security vulnerability in BG Remove, please report it responsibly:

  • Email: security@bgremove.site
  • Include steps to reproduce, the affected URL or endpoint, and its potential impact.
  • Do not publicly disclose the issue until we've had a chance to address it.

We aim to acknowledge security reports within 3 business days. We do not currently offer a bounty program, but we publicly credit researchers who report valid issues, with their permission.

8. Not in scope

The following are out of scope for security reports:

  • Reports of missing security headers that are already in place
  • Automated vulnerability scanner output without a demonstrated impact
  • Clickjacking on pages that do not perform sensitive actions
  • Rate limit bypass claims without evidence of exploitation
  • Self-XSS

9. Updates

We review dependencies and server software periodically. Cloudflare handles infrastructure patching for the static hosting layer.