Security Overview

An honest description of the security controls in place for the ReelBase website and application, and how to report a vulnerability.

Our approach

ReelBase is built so that the most valuable thing you have — your original footage — never has to leave your own storage. Only lightweight previews and metadata are sent to the cloud. On top of that design, we apply the controls below. We do not claim any security certification (for example SOC 2 or ISO 27001). Counsel to review this page so that no statement reads as a warranty.

This website (myreelbase.com)

• Encryption in transit: HTTPS with certificates managed by the Caddy web server, and HTTP Strict Transport Security (HSTS) so browsers always use HTTPS.
• Content Security Policy: every page is served with a strict policy using a fresh random value (nonce) per request; third-party sources are allowed only when a matching optional service is enabled.
• Security headers: protections against clickjacking, content-type sniffing and cross-origin window access, a strict referrer policy, and a permissions policy that disables camera, microphone, location, payment and USB access.
• Input handling: every form is validated again on the server, regardless of checks in the browser. Forms only accept same-origin submissions.
• Abuse prevention: rate limits on forms and endpoints, a hidden honeypot field and a minimum fill time to stop bots, and optional Cloudflare Turnstile.
• Minimal data: IP addresses are never stored in raw form — only a salted one-way hash used for rate limiting and abuse prevention. See our Privacy Policy.
• Secrets: API keys and credentials live in server environment variables, never in the code repository.
• Admin access: the website's admin area is limited to named staff with least-privilege roles (Owner, Admin, Sales), passwords hashed with Argon2, and sessions that expire after 12 hours.

The ReelBase application (app.myreelbase.com)

• Originals stay home: the ingest agent uploads only 720p previews, poster frames, sprite sheets and metadata. ReelBase has no delete access to your original files.
• Invite-only accounts: there is no public sign-up. Workspace admins invite users and assign admin or member roles.
• Passwords and sessions: passwords are hashed with scrypt and a unique salt; sessions use signed tokens in httpOnly cookies. Optional Google sign-in is available.
• Workspace isolation: each customer workspace (entity) is isolated; requests are scoped to the signed-in user's active workspace.
• Ingest agent keys: each agent has its own key, shown once and stored only as a hash; keys can be rotated, and the old key stops working immediately.
• Client review links: review links use unguessable tokens and can be protected with an optional passcode and an expiry date. Clients do not need an account.
• Media access: where DigitalOcean Spaces object storage is used, previews are served through signed URLs that expire after a short time. Confirm Spaces is enabled in production before publishing this statement.
• Optional AI: transcription and tagging send only audio extracted from previews, still frames or text to OpenAI and Anthropic, and only when enabled. See the Privacy Policy.
• Deletion sync: when source files are deleted, ReelBase removes its own copies after a 24-hour grace period, skipping drives that are offline.

What we are still working on

• No independent penetration test or audit has been performed yet.
• Backup schedule, encryption at rest and disaster-recovery objectives for the application to be documented and confirmed.
• Formal incident response plan to be documented (see breach notification duties in counsel's review).

Reporting a vulnerability

If you believe you have found a security vulnerability in ReelBase or this website, please email our contact page (replace with a dedicated security address, e.g. security@myreelbase.com, once it exists) with a description and steps to reproduce. Please:

• give us reasonable time to fix the issue before disclosing it publicly;
• avoid accessing or changing other people's data, degrading the service, or social engineering;
• test only against accounts you own or have permission to use.

We will acknowledge your report and keep you informed. We do not currently run a paid bug bounty. Counsel to confirm safe-harbor wording before promising not to pursue good-faith researchers.