Войти
Account passwords are never stored as text. They are saved as salted one-way hashes created with PHP's password_hash() function using its default algorithm, and they are checked with password_verify() when you sign in. A session is renewed with a new identifier after sign-in.
API keys are stored as keyed SHA-256 hashes (HMAC) and are only used to verify requests. A key can be rotated from the dashboard, and older readable copies of keys are cleared. Keep your key private, because anyone who has it can act as you through the API.
Actions that change your account, such as updating settings or deleting videos, require a CSRF token tied to your session, and the token is compared in constant time. The session cookie is marked HttpOnly and SameSite=Lax, so scripts on the page cannot read it and it is not sent with most cross-site requests.
Uploaded videos and their processed streaming files are saved in a private storage folder that the web server is configured to block from direct access. They are delivered through the application, which checks the request first. Delivered files are sent with cache headers that mark them private, so shared caches should not keep them.
Players receive short-lived playback sessions rather than permanent file addresses, and the default lifetime is 15 minutes. Download requests are recorded against a hashed version of the requester's IP address instead of the address itself, and the same applies to view counting.
Each video can be public or private, and you can switch selected videos to private from the dashboard. Private videos do not appear on public folder pages. Site moderators can still open any file when they handle abuse or copyright reports.
The HTTP API enforces per-account limits on requests per hour, requests per day and uploads per day (by default 250, 5,000 and 25), and answers with a 429 status and a Retry-After header when a limit is reached. Guest uploads from the home page are limited to ten temporary accounts per network address per day. Public forms such as the abuse report form have their own limits.
You can delete videos from the dashboard. Deleting a video removes its stored files and its database records. Account deletion is handled as a request through the contact page, and the privacy policy describes retention for backups and legal obligations.
The site detects when it is served over HTTPS and builds secure links in that case. Forcing every visit onto HTTPS, and the matching browser policies, are set up in the web server configuration rather than in the application code, so you should always check that the address bar shows a secure connection before you sign in.
If you find a security problem, please tell us through the contact page and include enough detail to reproduce it. Please do not access other people's data or disrupt the service while testing. To report abusive content instead, use Report abuse.
