Anything Download is designed as a bounded utility: it validates URLs, refuses private targets, limits file sizes, and deletes temporary data.
What we try to prevent
- Requests to internal, link-local, or loopback addresses.
- Oversized uploads and downloads.
- Password-protected PDFs and DRM-protected media.
- Long-term retention of user files.
What you should assume
Do not upload secrets, private keys, or documents you cannot afford to expose. Transport security depends on how this instance is deployed. Treat results as confidential only for as long as you keep the download link, and delete them when you are done.
Reporting a vulnerability
If you find a security issue, use the Contact page. Please include enough detail to reproduce the problem and avoid accessing other people's data while testing.