Screenshot APIs all send your page content to their servers — built a self-hosted one, looking for feedback

Описание и применение

Сервисы скриншотов SaaS отправляют содержимое страниц третьим лицам. Автор создал локальный сервис, чтобы сохранять данные в сети пользователя, но он не прошёл аудит безопасности и не поддерживает приватные IP.

Задача

SaaS screenshot APIs send captured page text to third‑party servers, exposing sensitive data behind logins.

Результат

The self‑hosted service keeps page content on the local machine, but lacks a security audit, has moderate extraction quality, and cannot yet capture private‑IP hosts due to SSRF guard.

Рабочий процесс

• 1. Identify need for private screenshot capture.
• 2. Search for self‑hostable screenshot solutions; none found.
• 3. Build a Docker‑Compose based service (shotbase).
• 4. Configure extraction to use a local model (e.g., Ollama).
• 5. Deploy and test against hosted APIs.
• 6. Gather feedback on usability and performance.

Доказательства

Every screenshot API is SaaS, which is fine, until you notice the page-understanding part runs on their model. So the text of every page you capture gets sent to a third party and processed there.

Источник

Runs with docker compose. The extraction part runs on whatever model you point at it — including Ollama on localhost, in which case the page text never leaves the machine that rendered it.

Источник

Honest about where it's weak: no security audit, extraction quality is decent not amazing, and you can't capture your own private-IP hosts yet because the SSRF guard blocks RFC1918 with no opt-out (allowlist is the next thing I'm building).

Источник