Security practices
How Pixoraid Detect protects uploads, accounts, and API access — from the browser to the backend.
Partner API keys should be stored as environment secrets, never shipped in mobile or frontend source code. Rotate any key that may have been exposed.
Admin routes require an admin key or signed session cookie. Production deployments use strong secrets and HTTPS at the edge.
The backend enforces upload limits and rate limits, with logs enabled for operational review and abuse investigation.
Sign-in is handled by Google via Firebase Authentication — Pixoraid never sees or stores your password.
All traffic to pixoraid.com is served over HTTPS with automatically managed certificates.
Found a vulnerability? Email us and we will respond quickly. We appreciate responsible disclosure.
Security is a process, not a checkbox — these practices evolve with every release.