Updated
Security
Simple publishing. Clear boundaries.
Encrypted connections
The ALREADY UP application and customer sites use HTTPS/TLS. Uploads go directly from your browser to private Google Cloud Storage over HTTPS.
Private storage, public links
Our storage buckets block public access. Published files are delivered through our serving service. Anyone with a live link can view the published files, so do not publish passwords, private documents or other secrets.
Narrow upload permissions
Customer file bytes do not pass through the control API request body. The API checks the file manifest and issues short-lived signed upload authorizations for exact objects. Publication is made live only after uploaded objects are verified. ALREADY UP does not run server-side builds or execute uploaded code.
Separate domains and identities
The application lives on alreadyup.dev. Customer content lives on a separate registrable domain, alreadyup.page. Service identities have permissions limited to their roles. Customer HTML may run scripts in a visitor’s browser; a hosted link is not an endorsement of its contents.
Report a concern
For a suspected vulnerability in ALREADY UP, email ukukudu@gmail.com with a description and safe steps to reproduce it. Do not include credentials or customer data, and do not test against other people’s content.
For harmful hosted content, follow the abuse reporting instructions. We can suspend access and remove content when needed. We do not promise a fixed response time.