Upload and workbook safety
- Uploads have a 25 MB compressed file limit.
- XLSX magic bytes, ZIP structure, decompression size, entry count, worksheets, rows, cells, and compression ratio are bounded.
- Encrypted, macro-enabled, executable, path-traversal, and corrupted archives are rejected.
- Formula and macro execution are never enabled.
Private workspace controls
Guest jobs use high-entropy bearer links. Authorization is checked for job reads, changes, deletion, and downloads. Mutation requests require the expected origin, and private responses prevent browser caching.
Anyone with a complete guest link can access that job until it expires or is deleted. Treat the link like a temporary password and do not forward it.
Repair integrity
Selected replacements are limited to intended cells. SKUFix reopens the generated workbook, checks expected values, rejects unrelated cell changes, records a checksum, and protects generated CSV reports from formula injection.
Retention and deletion
Source files and generated artifacts are scheduled for deletion after 24 hours. A seller can also delete the job from the private workspace.
Current operational limit
Rate limiting is currently best effort per serverless function instance. A shared edge rate-limit store is required before high-volume paid use.
Report a vulnerability
The contact page shows the current disclosure channel status. The dedicated inbox is not active yet. Do not attach a real seller workbook, access data that is not yours, or continue testing when a report cannot be delivered safely.