How files are handled

Uploads are capped at 90 MB and must be zip files. The converter rejects too many entries, huge expanded sizes, path traversal, symlinks, and encrypted entries. HTML output is escaped.

Conversion runs in a separate container with no network. Files live on a private volume and are deleted after 24 hours. The database stores counts, not message text.

GitHub sign-in does not keep access tokens. Card data stays with Dodo Payments.