Designing a Privacy-Safe Gift Card Image Submission Pipeline

A gift card image is not an ordinary profile photo. It can contain a redeemable code, a PIN, a receipt, an email address, an order number, and location metadata from the camera. A single authorization bug can therefore expose both personal data and something that behaves like a bearer secret. This article designs the upload path as a security boundary. The examples are implementation-neutral TypeScript so the controls can be mapped to your framework, image decoder, object store, and queue. The goal is not “secure file upload” in the abstract. It is a narrower property: Collect only the evidence needed for a decision, keep the original out of normal review paths, and make every retained copy private, attributable, and short-lived. Start with staged disclosure Do not begin by asking for the entire card and receipt. Most first-pass routing decisions need only structured facts: brand and issuing country currency and face value physical card or e-code proof type available whether the redeemable area is still covered Only request an image after those fields show that visual proof is necessary. For the first image, instruct the user to keep the code or PIN covered and exclude unrelated receipt lines. If a later step genuinely needs a live code, collect it through a separate, purpose-built secret field—not as another image in a support chat. That separation changes the failure mode. A bug in the ordinary proof viewer should not automatically reveal a spendable credential. The FTC explains why the distinction matters: someone who has the gift card number and PIN may be able to take the funds even without holding the physical card. Treat those values as secrets, not harmless text printed in a photo. Threat-model the whole path An upload control on the browser is useful feedback, but it is not a trust boundary. Model at least these failures: Threat Example Required control Secret exposure A full PIN appears in a proof image or log Staged disclosure, detection, restricted escal