Trust
Security policy
PasteOkay stores text that people expect to disappear. Security reports are welcome, especially when they show a way to read a paste without its key, reach the operations console or keep content alive past its expiry.
Effective
Report a vulnerability
Email [email protected] with the subject “Security report”. Please do not open a public issue or post details before a fix is available.
A useful report includes:
- The affected route, file or configuration key.
- The smallest set of steps that reproduces the problem.
- What an attacker gains and how much access they need to start.
- Any suggested remediation.
You will get an acknowledgement within a few days. Please allow time for a fix and a release before publishing details.
In scope
- The Pages Functions in the deployed worker and the shared server code.
- The client-side scripts served from this origin.
- Cryptographic handling: key derivation, storage encryption, password hashing and session tokens.
- Access control on the operations console and every route under
/api/. - Expiry, burn after reading and deletion behaviour.
Out of scope
- Vulnerabilities in the Cloudflare platform itself. Report those to Cloudflare.
- Volumetric denial of service. The service relies on the platform's edge for that.
- Findings that require the operator's own secrets or only affect a deployment you control.
- Deliberate design choices described in the documentation, such as the operator being able to read a stored paste that was not encrypted in the browser.
What the service is designed to guarantee
- Stored pastes are encrypted at rest with AES-256-GCM, so a database dump alone reveals nothing.
- A paste encrypted in the browser can only be decrypted with the key in the URL fragment, which browsers do not send to the server.
- Paste passwords are derived in the browser and compared in constant time.
- Expired pastes stop resolving on every read, before any background cleanup runs.
- Two-factor authentication is required for the console, and destructive actions require a fresh code.
- Rate limiting uses a keyed, rotating fingerprint rather than a raw IP address.
Rate limiting, blocking and honeypots are deterrents rather than hard guarantees. A useful report describes a concrete bypass with an impact, not the mere existence of a limit.
Supported versions
The currently deployed version is the supported version. Fixes are applied to the live service. There is no long-term support branch for older deployments.