Security Overview

At VectorGraph, we understand that you may be extracting data from sensitive, proprietary, or embargoed academic charts. Our architecture is designed from the ground up to ensure your data remains secure.

1. The "Offline-First" Sandbox

Unlike traditional SaaS applications, VectorGraph runs entirely within the sandbox of your web browser. When you upload an image, it is read into your device's memory using standard HTML5 File APIs. All computer vision algorithms — including Pixel Harvest, Auto Trace, Auto Bar, OCR axis detection (Tesseract.js), and image enhancement filters — are powered by WebAssembly (OpenCV.js) and run entirely on your device's CPU.

Because the image never leaves your device during extraction, there is zero risk of your proprietary charts being intercepted over a network, stored on an unsecured server, or viewed by our staff.

2. Data in Transit (HTTPS)

While the core application is offline, certain assets (like OCR language models, which are cached after the first download) and the Excel export feature require network requests. VectorGraph enforces strict TLS 1.3 encryption (HTTPS) for all network traffic. We do not support insecure HTTP connections.

3. Backend API Hardening

For operations that require a backend server (generating complex .xlsx workbooks with Math Tools, Fit Results, and embedded chart sheets), we employ the following security measures:

• In-Memory Processing: Data payloads sent to our FastAPI backend are processed entirely in RAM and immediately flushed after the response is returned. They are never written to disk, logged, or persisted in any form.
• Payload Size Limit (DoS Protection): A custom LimitUploadSize middleware enforces a hard cap of 10 MB per incoming request, preventing oversized payloads from causing resource exhaustion or Denial of Service (DoS) attacks.
• IP-Based Rate Limiting: The backend uses SlowAPI to enforce per-IP rate limits on all API endpoints, mitigating brute-force and scripted abuse attempts.
• Strict CORS Policy: Cross-Origin Resource Sharing (CORS) is restricted to explicitly defined allowed origins loaded from environment variables. Only requests from the official vectorgraph.in domain are accepted in production.
• API Surface Minimization: OpenAPI specification endpoints (/openapi.json), Swagger UI (/docs), and ReDoc (/redoc) are completely disabled in production to reduce the attack surface and prevent API reconnaissance.

4. Content Security Policy (CSP)

The VectorGraph application enforces a strict Content Security Policy (CSP) header. This prevents Cross-Site Scripting (XSS) attacks by explicitly restricting which scripts, styles, and connections are permitted to load within the application context.

5. Export Security

• CSV Formula Injection Sanitization: All values exported to CSV are sanitized to prevent formula injection attacks (where a cell value like =CMD() could be executed by spreadsheet software).
• HTTP Security Headers: The application sets X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers to prevent MIME sniffing and clickjacking.

6. Vulnerability Disclosure

We welcome security researchers to responsibly disclose any vulnerabilities found in the VectorGraph application or backend API. Please report security issues directly to support.vectorgraph@gmail.com with a clear description and reproduction steps. Do not create public GitHub issues for unpatched security exploits.

Out-of-scope vulnerabilities include social engineering attacks, physical access attacks, and attacks requiring compromised user devices. We commit to acknowledging valid reports within 48 hours and providing a fix timeline.