Pullify · Algora Labs
Security Policy
Last updated: July 27, 2026
This page covers how Pullify is built with security in mind, and how to report a vulnerability if you find one.
No credentials requested
Pullify never asks for your login credentials on YouTube, Instagram, Facebook, TikTok, or any other platform. It only processes links to publicly available content, so there's no account password or session token for the service to handle or expose in the first place.
Request handling
Pullify's website acts as a proxy in front of a separate backend service that performs the actual media lookups and downloads. Requests to fetch media info or start a download pass through this proxy layer rather than exposing the backend directly, and file downloads are streamed through rather than stored longer than necessary to complete the transfer.
Browser-level protections
The site sends standard security headers on every page — including a Content Security Policy, X-Frame-Options, X-Content-Type-Options, and a Referrer-Policy — aimed at reducing risks like clickjacking and content-type sniffing attacks.
Reporting a vulnerability
If you believe you've found a security issue with Pullify, email support@pullify.algoralabs.site with details and, if possible, steps to reproduce it. Please report vulnerabilities privately rather than publicly before we've had a chance to address them.