Security fixes are provided only for the latest version on the default branch.
If you report an issue against an older copy, fork, or self-hosted deployment, reproduce it against the latest version first.
Please do not open a public issue for suspected security problems.
Instead:
- Use GitHub's private vulnerability reporting for this repository, if it is enabled.
- If private reporting is not available, contact the maintainer privately through GitHub.
- Include clear reproduction steps, affected browser and OS, impact, and a minimal proof of concept if possible.
Useful details to include:
- browser and version
- operating system
- whether the issue happens in normal mode, PWA mode, or both
- whether the issue depends on a specific file type such as PNG, WEBP, AVIF, or SVG
- whether the issue requires a crafted file, crafted filename, share link, or batch input
You can expect:
- acknowledgement after review
- a decision on whether the report is a real security issue
- a fix or mitigation when the report is valid and reproducible
MyPixel is a browser-based pixel art enhancement tool that runs client-side, supports batch processing, exports to multiple formats, generates shareable links, and can be installed as a PWA.
Because of that, the most relevant security areas are:
- client-side code execution or DOM injection
- unsafe handling of SVG, Base64, filenames, or share-link parameters
- data exposure through generated URLs, browser history, clipboard, cache, or PWA storage
- denial of service caused by extremely large or malformed inputs
- service worker or cache behavior that exposes stale, unexpected, or unsafe content
Examples of valid security reports include:
- cross-site scripting (XSS) or DOM-based injection
- arbitrary script execution through imported files, generated exports, or share-link handling
- unsafe SVG generation or rendering that can execute active content
- clipboard abuse beyond the expected export or copy actions
- private image data leaking through URLs, browser history, cache, or unexpected persistence
- service worker or offline cache behavior that exposes content in a way users would not reasonably expect
- denial of service through crafted files that freeze or crash the app far beyond normal usage limits
- dependency or supply-chain issues that materially affect users of this repository
The following usually do not count as security vulnerabilities by themselves:
- normal force-close, slowdown, or memory use when processing very large files
- expected visibility of data that the user explicitly puts into a shareable link
- breakage in unsupported browsers or modified self-hosted deployments
- cosmetic UI bugs without security impact
- feature requests related to permissions, UX, or workflow
- reports without a realistic impact explanation
This project aims to keep processing on the client side. That means:
- uploaded images should stay on the user's device unless the user explicitly exports, copies, or shares data
- generated share links should be treated as sensitive if they contain encoded image data
- active content should never be introduced into exports unintentionally
- user-controlled values should be treated as untrusted input everywhere
If you use or self-host MyPixel:
- avoid sharing links that contain sensitive artwork or private images
- treat generated Base64 share links as data disclosure if posted publicly
- keep your browser updated
- review any custom modifications before self-hosting publicly
- test exported SVG output in your environment if you embed it into other sites or tools
Please allow time for investigation and remediation before public disclosure.
Once a valid issue is understood and a fix is available, coordinated disclosure is preferred.