Security

Safeput reduces the work required to quarantine and inspect untrusted files. It does not make arbitrary files harmless, and a clean verdict is not a substitute for application-level authorization or safe file handling.

Keep project keys server-side

An sp_test_... or sp_live_... key grants access to one project. Never embed it in browser code, mobile applications, logs, or source control. Create separate test and live projects, rotate exposed keys, and revoke unused keys.

Treat files as untrusted until clean

Do not release, parse, preview, or transform uploaded bytes while an upload is waiting, uploaded, or scanning. A rejected or failed upload is never available for download. A failed verdict means inspection did not complete; it must not be treated as clean.

Keep retrieval private

Download URLs are short-lived bearer credentials. Return them only after your application has authorized the requesting user, avoid logging them, and do not cache them. Safeput streams clean files as attachments with a sanitized filename, detected content type, nosniff, and private, no-store headers.

Verify webhook signatures

Verify the signature over the exact raw body, reject stale timestamps, process event IDs idempotently, and return success only after the event is durable. See Webhooks for the complete signing contract.