Security & limits

SSRF prevention

Every source URL is resolved and validated before the API fetches it. Requests targeting loopback, private (RFC 1918), link-local, or unspecified IPv4/IPv6 ranges are rejected — this includes DNS rebinding attempts, since the resolved IP is checked, not just the hostname string.

Domain allowlisting

Deployments can restrict which origin domains are fetchable via ALLOWED_DOMAINS. When unset, any public domain is allowed (subject to the SSRF checks above).

Rate limiting

Per-hostname rate limiting: 100 requests per 60-second window by default (RATE_LIMIT_MAX, RATE_LIMIT_WINDOW_MS).

Size limits

Source images larger than 20 MB by default (MAX_IMAGE_SIZE_MB) are rejected with SIZE_EXCEEDED before processing.

Resilience

Upstream fetches retry with exponential backoff (FETCH_MAX_RETRIES, FETCH_RETRY_BASE_MS) and sit behind a circuit breaker per origin — after repeated failures, further requests to that origin short-circuit immediately (CIRCUIT_BREAKER_OPEN) instead of piling up on a dead upstream.

Data handling

The service does not persist uploaded or fetched images beyond an in-memory processing cache — there is no user data store.