1. End-to-End Encryption in Transit
Every transaction between your web browser and WaveForge is protected with robust TLS 1.3 / HTTPS encryption with HTTP Strict Transport Security (HSTS). All audio payloads, API calls, and parameter transfers are fully encrypted in transit.
2. Ephemeral Sandboxed Scratch Space
Audio extraction and sample transcoding take place in isolated operating system scratch spaces generated with cryptographically unique UUIDs (tempfile.mkdtemp()). Key isolation properties include:
- Each conversion task operates in an isolated temporary directory completely partitioned from other concurrent users.
- Upon completion of the client download, a mandatory
@after_this_requestlifecycle handler purges the temporary workspace directory from disk immediately.
3. FFmpeg Process Hardening
All audio transformations execute using strictly parameterized FFmpeg invocations. Input parameters (sample rate, channels, timestamps) are rigorously validated and cast to safe representations prior to execution, preventing command injection vulnerabilities.
4. Concurrency Throttling & Anti-Abuse Controls
To ensure high availability and prevent denial-of-service starvation:
- Our backend enforces an atomic Semaphore-based concurrency queue limiter.
- In-memory sliding-window IP rate limiters mitigate abusive automation scripts, reserving engine capacity for legitimate creative professionals.
5. Responsible Vulnerability Disclosure
We welcome security researchers and ethical hackers who identify potential security issues to disclose them responsibly. If you discover a vulnerability, please contact our security team: