Security

Provider credentials stay on the server. The generation endpoint is limited to local private testing, checks same-origin requests, validates image type, signature and file size, and requires a consent confirmation. It uses a conservative in-process attempt limit, not a durable distributed rate limit. Job history and video access are tied to a signed, HttpOnly browser cookie; a Video Code by itself cannot retrieve a video on another device. Completed videos are copied to a private R2 bucket when storage succeeds.

File validation does not verify age, identity, consent, or whether a photo contains explicit or graphic content. We have not implemented automatic content moderation or universal manual pre-review. Follow the Acceptable Use Policy; the AI provider may independently reject requests.

Public payments are disabled. Verified checkout and order webhooks, durable cost controls and rate limiting, and reliable paid-order failure and refund handling still need to be built before a public paid launch. R2 lifecycle deletion for generated objects must be configured separately; the application limits download access to three days but cannot by itself guarantee physical deletion at that time. We cannot guarantee when a provider removes its copies.

If you find a security, privacy, or abuse issue, email hello@zombievideolab.com with the affected URL, time, and safe reproduction steps. Do not attach another person's photos, probe other users' data, or disrupt the service. We cannot promise a fixed response deadline during private testing.