Upload sanitisation
Upload sanitisation strips everything a browser could execute out of an uploaded file before it is stored. To the eye, the file is unchanged.
Some file formats are more than an image. By definition they may contain instructions that a browser executes while displaying them. As long as the file comes from a trusted source that is harmless; the moment somebody else can upload, it becomes an open route into your own site.
Cleaning therefore happens before storage, not at display time. Executable parts and outbound references are removed from the file while what is shown stays intact. Anyone looking at the result notices no difference — what is missing was never meant for the eye anyway.
Timing is what matters: a check that only happens in the visitor's browser arrives too late and can be bypassed. And it belongs at every point where files come in — not only the obvious one in the editing area, but also forms that accept attachments.
Frequently asked questions.
Are uploaded files on my website a risk?
In short: yes, uploaded files can be a risk — which is why with us they are checked and cleaned as they are saved, not only when they are displayed.
The classic case is a logo in SVG format. An SVG is not an image made of pixels but a text document containing instructions — and those instructions can include scripts. If such a file is served from your own address and opened directly, the code inside it runs in the context of your domain.
btlabs Core therefore applies an allowlist principle: on upload only harmless elements and attributes get through, everything else is discarded. File types that are not permitted are never accepted in the first place.
What you can do yourself: upload logos and graphics from sources you trust, and ask any provider whether files are checked on upload — or whether anything that fits is simply accepted.
Do I have to take care of maintenance, backups or security?
No. EU hosting, isolated per partner — backups and security patches run automatically in the background. Larger system updates we sort out together when they come up.
Is it GDPR-compliant?
Yes. Hosting in the EU, isolated per partner, cookieless. Data access and deletion at the push of a button.