How the site is protected
- Encrypted connections only. HTTPS is enforced, with HTTP Strict Transport Security (HSTS).
- Strict Content Security Policy. Only this site's own scripts can run. Inline code is blocked, except one small script allowed by its SHA-256 hash. Other sites cannot embed these pages in a frame.
- No third-party content. Fonts, scripts and images are served from this site.
- No accounts. There are no logins or passwords to steal.
- Careful uploads. Only requests from this site are accepted, and they are size-limited and rate-limited. A subtitle file must be valid UTF-8 text in SRT or WebVTT format. It is parsed and rewritten as plain text, stored with parameterised database queries, and never served to anyone until a reviewer has checked it.
- Data minimisation. IP addresses are not stored, and submissions are deleted automatically after 12 months. Privacy
- Local tools. The checker and the converter run in your browser, so files you check never reach the server.
Report a vulnerability
If you find a security problem, email translation@foundation.ge with the subject “Security”, and include the steps to reproduce it. Contact details are also published in security.txt.
When testing, please:
- do not access, change or delete other people's submissions
- do not disrupt the site, for example with denial-of-service or high-volume automated scanning
- give reasonable time to fix a problem before you publish it
Good-faith research that follows these rules is welcome.