Security and data handling

Encryption in transit

The API, the visualizer and every image link are served over HTTPS only, so keys, room pictures and images are encrypted between your systems and ours.

Key security

• Keys are long random values that say nothing about your workspace. Each is shown once, when it is created, and cannot be retrieved afterwards, even by us.
• Keys are read only from the Authorization header, never from URLs, so they stay out of logs and browser history.
• A revoked key stops working at once. No endpoint creates keys, so a leaked key cannot be used to make more.
• Each key has its own rate limit, so a runaway script is held back rather than flooding your workspace.
• Publishable keys can open only the visualizer, and only on the websites listed on them.

Your part is to keep secret keys on your servers. See Keep secret keys safe.

Catch leaked keys

Secret keys have a fixed shape, so a scanner can find one committed by mistake before it ships. Add this pattern to your repository’s secret scanning, such as a custom pattern in GitHub secret scanning or a rule in a pre-commit hook:

sk_live_[A-Za-z0-9_-]{32}

Workspace isolation

Every request acts on the workspace its key belongs to, and only that workspace. A scene, product or render of another workspace is reported as 404 not_found, exactly like one that does not exist, so nothing about other workspaces can be learned from the API.

Image link security

• Image links are signed, so they cannot be guessed, and they expire after at least 30 days.
• Anyone holding a link can open the image until then, without a key. Share links only where you would share the image, and serve images from your own storage.

How your images are used

We do not use your content to train or fine-tune AI models. How the pictures you send are processed to make your renders, and by whom, is set out in the Privacy Policy. Renders made from your content are yours, as the Terms of service say.

Shopper data

Shoppers’ room photos from the website visualizer are deleted after 30 days, or at once when the shopper chooses to, and never appear in your gallery. See Shopper privacy and data retention.

Report a security issue

Found a vulnerability, or think a key or an image has been exposed? Email admin@skipshoot.com with “Security” in the subject and what you found. Never include a key, and please give us a chance to fix an issue before you share it.