Use a trusted server boundary
Keep your ModeraLens API key on a trusted application server. Use HTTPS for your application and restrict workspace access to authorized members of your organization.
Do not proxy arbitrary user-selected targets through your image host. An allowlisted public hostname must serve images you intend the system to access.
Image URLs are untrusted input
The image fetch boundary requires HTTPS and an exact allowed hostname. Private IPv4 and IPv6 addresses and redirects are rejected. These restrictions help prevent requests to internal services.
URL checks are not an assertion about the image’s content. Decoding and size checks separately enforce supported static JPEG, PNG, and WebP files, with defaults of 10 MiB and 16 megapixels.
Do not weaken host or network validation to make a failing URL work. Serve the image directly from a permitted public host instead.
Protect secrets and records
- Keep your integration key on your application server.
- Exclude credentials from version control and analytics.
- Redact authorization headers and sensitive image URL query strings from logs.
- Use separate credentials for separate applications.
- Use a trusted browser and sign out when finished.
Handle uncertainty explicitly
A failed job produces a review outcome; it is never a pass. Service unavailability, missing results, or unsupported policy categories should enter your own review workflow.
This workspace displays decisions and inspection detail. It does not change your source content or implement a persistent human approval system. Record any human review decisions in your application’s audit system.