Inspect public image URLs before imports. Check HTTP status, fully decode supported static images, and report dimensions, size and exact duplicates in JSON/CSV. Pay $0.001 per qualifying result. Does not convert images or guarantee importer acceptance.
Later approved evidence (2026-10-17): existing build0.0.2/product0.1.3+schema fix completed one four-input run (two PNG successes including a duplicate; file/ftp refused). Dataset/KV JSON/CSV64 cells matched; actual2GB,4.046s,peak53,657,600B,run usageUSD0.0006281835 excluding ongoing storage/later reads. No newbuild/0.1.4 deployment, no retry/publication/price/permission change. Prior single-PNG statements below describe the initial run. See APIFY-SAFE-FOUR-TEST.md;72 local tests were not rerun for this evidence-only update.
Revision 0.1.4: Dataset dialect compatibility hotfix. Private Apify build 0.0.2 and one small public PNG run succeeded with the same 0.1.3 runtime plus this schema fix. See APIFY-CLOUD-TEST.md and APIFY-CLOUD-EVIDENCE.json. Earlier unexecuted/blocked statements below are historical. No Store publication, charging or Shopify import verification.
0.1.3
Add official Actor output-link and Dataset schemas, connected from actor.json. No execution-code or local input/output contract changes. Static staging review: 28 checks passed. Cloud validator, build/run and output retrieval remain unexecuted; browser upload permission is unresolved. PPE remains disabled.
Changelog
0.1.2 — independent review P2-1 correction
Reject CLI input/output collisions, resolved aliases and same-file links before fetching. Refuse existing outputs and reserve both names with exclusive creation, preventing overwrite races.
Bound JSON input reads and clean up only this run's first reservation if reserving the second output fails.
Add 12 socket-free file-safety regressions: current product suite 64/64; adapted independent review 12/12.
Preserve network API, row fields and exit-code meanings. Existing-output overwrite behavior is intentionally removed. Public-release holds remain.
0.1.1 — unpublished security review revision
Connect directly using a literal-IP socket for IPv4/IPv6; no second getaddrinfo call even for the numeric destination. Repeat the public-IP check immediately before socket creation.
Reject ambiguous Content-Length/Transfer-Encoding, unsupported transfer encodings, transport compression, partial responses and malformed redirect URLs. Supported chunked responses are decoded through the real HTTP parser under the byte cap.
Bound consumed response wire bytes, including headers and chunk trailers, to the configured body limit plus 64 KiB.
Normalize recorded Content-Type to known media types and omit arbitrary parameters/text. Broaden CSV formula-prefix protection to whitespace, newline and BOM cases.
Add socket-free security fixtures for framing, DNS pinning/rebinding, private IP forms, proxies, TLS checks, credential URLs, cookies, secret redaction and decode bombs. Replace the old real-loopback timeout test with mocks.
Fix the benchmark supervisor's pipe-buffer deadlock when logging a larger test suite; output goes directly to a local file.
Preserve input keys, defaults, row ordering, output fields and CLI exit codes. Add fail-closed reason codes; no public cloud release.
0.1.0 — initial local candidate
Initial CLI, Python API, optional Actor adapter, contracts, documentation and 22-test baseline. Baseline public-image and local Actor evidence is retained and explicitly distinguished from the 0.1.1 mocked security review.