Security

Last updated: 2026-09-26

This is how BlackScreen.VIP is built and what it can and cannot protect. For the data-handling side, see Privacy.

Architecture

  • Static site — HTML, CSS, and JavaScript served from Cloudflare Pages. No database to break into.
  • Browser-side processing — the color tools render in this tab. The “work” is one background paint and one canvas call. Nothing user-generated is shipped to the origin.
  • Content Security Policy — pnpm build writes a strict CSP for every HTML file. Inline style= attributes and on* event handlers fail the build, so stray script injection is much harder.
  • No accounts — no password database, no session tokens, no OAuth secrets to leak.
  • One write endpoint — the header Help / Feedback form, at feedback-hub.pvb-259.workers.dev. It accepts only what you type, not page state.
  • Optional analytics — Plausible (self-hosted), optionally Microsoft Clarity (delayed), optionally Cloudflare Web Analytics. Production only; local preview does not load them.

What this model reduces

  • Accountless — a leak of user credentials is impossible when there are none.
  • No upload surface — your screen activity stays on your device by design.
  • Tight CSP — inline-script injection is structurally blocked at build time, not just detected later.
  • Static host — Cloudflare Pages provides the usual platform protections: WAF, DDoS mitigation, and signed TLS.

What this model does not prevent

  • A malicious browser extension on the machine using the tool.
  • A shared or compromised computer.
  • Shoulder-surfing and screen recording.
  • Look-alike domains. Always check the address bar shows blackscreen.vip.
  • Secrets you deliberately paste into the Feedback form or email — never do that.

Reporting a vulnerability

Email [email protected] with:

  • The URL of the affected page
  • Steps to reproduce
  • What you observed (e.g., an unexpected network call, a CSP violation, a script that shouldn’t be there)
  • Impact — who could be harmed and how

Please do not include live secrets, other people’s personal data, or proof-of-concept code that would harm the site. Redact first, share second.

There is currently no paid bug-bounty program.

Third-party surfaces

These are the only external parties the production site touches. Each is covered in Privacy.

Party Role
Cloudflare Pages Static host
Feedback Hub (Cloudflare Workers) Optional feedback inbox
Plausible (self-hosted) Optional page analytics
Microsoft Clarity Optional session replay
Cloudflare Web Analytics Optional zone metrics
Ko-fi Optional external link, no data exchanged unless you choose to tip

Privacy · Contact · About