Is Cloudinary Safe?
Security analysis for apps built with Cloudinary. Media management platform with image/video optimization, transformation, and CDN delivery.
Is Cloudinary safe? The short answer
Yes, Cloudinary is a safe and established service for storing, transforming and delivering images and videos. Serving media through its CDN or using its upload widget does not create a vulnerability by itself, and your cloud name and API key are identifiers that commonly appear in frontend code.
The risk comes from two settings that AI-generated code often gets wrong. The first is the API secret: with it, anyone can upload, overwrite or delete any asset in your account. The second is unsigned uploads: they are convenient for a quick prototype, but an unsigned upload preset lets anyone who knows your cloud name and preset name push files into your account. Is Cloudinary safe? The platform is; whether your app is depends on these choices.
Scan your Cloudinary app now
Enter your URL and get a full security report in 30 seconds. Free, no signup required.
Scan Your Cloudinary AppCloudinary misconfigurations we see in AI-built apps
The api_secret in client code
The api_secret, or a full CLOUDINARY_URL (cloudinary://key:secret@cloud), placed in a NEXT_PUBLIC_ or VITE_ variable ships with your JavaScript. It grants full Admin and Upload API access. It belongs on the server only.
Unsigned uploads with an unrestricted preset
An unsigned preset with no limits on formats, file size or destination folder lets anyone upload large files or unwanted content, which is then served from your account's CDN URLs. If you need unsigned uploads, restrict the preset tightly; for anything user-facing, prefer signed uploads.
Unlimited on-the-fly transformations
Dynamic transformation URLs let anyone request new variants of your assets, which consumes your transformation quota. Cloudinary's strict transformations setting limits delivery to transformations you have approved.
Private files delivered as public assets
Assets uploaded with the default delivery type are publicly reachable by URL. For invoices, IDs or private user content, use authenticated or private delivery types with signed URLs.
Cloudinary security checklist
- Search your bundle for
api_secretandcloudinary://; if the secret leaked, generate a new API key pair in the Cloudinary console and revoke the old one. - Sign uploads on your server and only send the signature, timestamp and API key to the browser.
- If you keep unsigned presets, restrict allowed formats, maximum file size and target folder.
- Enable strict transformations if you do not need arbitrary transformation URLs.
- Use authenticated or private delivery for sensitive files.
// app/api/sign-upload/route.ts — server only
import { v2 as cloudinary } from "cloudinary";
export async function POST() {
// Check that the user is logged in before signing.
const timestamp = Math.round(Date.now() / 1000);
const signature = cloudinary.utils.api_sign_request(
{ timestamp, folder: "user-uploads" },
process.env.CLOUDINARY_API_SECRET!,
);
return Response.json({ timestamp, signature, apiKey: process.env.CLOUDINARY_API_KEY });
}Common Security Issues in Cloudinary Apps
Exposed API Keys
AI coding tools often embed API keys directly in frontend JavaScript. If you're using Cloudinary, check that secret keys aren't in your client-side bundle.
Missing Security Headers
Headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options protect against XSS, clickjacking, and downgrade attacks.
Vulnerable Dependencies
Outdated npm packages with known CVEs are common in AI-generated code. Regular audits catch these before attackers do.
Authentication Weaknesses
Open registration endpoints, missing rate limiting, and exposed auth tokens are frequent issues in vibe-coded apps.
What ScanVibe Checks
Frequently Asked Questions
Is Cloudinary safe to use?
Cloudinary itself is a reputable platform, but apps built with Cloudinary often have security misconfigurations — exposed API keys, missing security headers, and vulnerable dependencies. ScanVibe scans your app to find these issues.
What security issues do Cloudinary apps commonly have?
The most common issues we find in Cloudinary apps are: exposed API keys in frontend JavaScript, missing security headers (CSP, HSTS), outdated dependencies with known vulnerabilities, and misconfigured authentication endpoints.
How do I check if my Cloudinary app is secure?
Enter your app's URL in ScanVibe's scanner. We'll check for exposed secrets, security headers, vulnerable libraries, exposed files, and platform-specific misconfigurations — all in about 30 seconds.
Does ScanVibe scan Cloudinary specifically?
Yes. ScanVibe detects Cloudinary in your stack and runs platform-specific security checks in addition to our standard 8-category analysis.
Is it safe to expose my Cloudinary API key and cloud name?
The cloud name and API key are identifiers and commonly appear in frontend code; they are not enough on their own to modify your account. The API secret is different: it must stay on the server. If it was ever shipped to the browser or committed, generate a new key pair and revoke the old one.
Are Cloudinary unsigned uploads safe?
Only with a tightly restricted upload preset. Anyone who knows your cloud name and preset name can use an unsigned preset, so limit formats, file size and destination folder, or switch to signed uploads where your server generates a signature for each authenticated user.
Other Storage & CDN to Check
Don't guess — scan.
Find security issues in your Cloudinary app before attackers do.
Scan Your App Now