# Security

Safe integration boundaries for keys, untrusted files, verdicts, and downloads.

Safeput reduces the work required to quarantine and inspect untrusted files. It
does not make arbitrary files harmless, and a clean verdict is not a substitute
for application-level authorization or safe file handling.

## Keep project keys server-side

An `sp_test_...` or `sp_live_...` key grants access to one project. Never embed
it in browser code, mobile applications, logs, or source control. Create
separate test and live projects, rotate exposed keys, and revoke unused keys.

## Treat files as untrusted until clean

Do not release, parse, preview, or transform uploaded bytes while an upload is
`waiting`, `uploaded`, or `scanning`. A `rejected` or `failed` upload is never
available for download. A `failed` verdict means inspection did not complete;
it must not be treated as clean.

## Keep retrieval private

Download URLs are short-lived bearer credentials. Return them only after your
application has authorized the requesting user, avoid logging them, and do not
cache them. Safeput streams clean files as attachments with a sanitized
filename, detected content type, `nosniff`, and `private, no-store` headers.

## Verify webhook signatures

Verify the signature over the exact raw body, reject stale timestamps, process
event IDs idempotently, and return success only after the event is durable. See
[Webhooks](/docs/webhooks/) for the complete signing contract.