Screenshot APIs all send your page content to their servers — built a self-hosted one, looking for feedback

说明与用途

SaaS 截图 API 会将页面内容发送给第三方。作者构建了本地服务以保持数据在用户网络内，但尚未通过安全审计，且无法捕获私有 IP。

问题

SaaS screenshot APIs send captured page text to third‑party servers, exposing sensitive data behind logins.

结果

The self‑hosted service keeps page content on the local machine, but lacks a security audit, has moderate extraction quality, and cannot yet capture private‑IP hosts due to SSRF guard.

工作流

• 1. Identify need for private screenshot capture.
• 2. Search for self‑hostable screenshot solutions; none found.
• 3. Build a Docker‑Compose based service (shotbase).
• 4. Configure extraction to use a local model (e.g., Ollama).
• 5. Deploy and test against hosted APIs.
• 6. Gather feedback on usability and performance.

证据

Every screenshot API is SaaS, which is fine, until you notice the page-understanding part runs on their model. So the text of every page you capture gets sent to a third party and processed there.

来源

Runs with docker compose. The extraction part runs on whatever model you point at it — including Ollama on localhost, in which case the page text never leaves the machine that rendered it.

来源

Honest about where it's weak: no security audit, extraction quality is decent not amazing, and you can't capture your own private-IP hosts yet because the SSRF guard blocks RFC1918 with no opt-out (allowlist is the next thing I'm building).

来源