Security

Security here is a standing part of the work, and the site has been audited as an attacker would. This page says what protects your account and how to tell us if you find a gap.

What protects your account

• Everything is served over HTTPS, with HSTS, a strict content security policy, and the component previews isolated on a separate origin.
• Passwords are hashed with scrypt and a per-account salt; the original never leaves your browser in storable form and is never logged.
• Signing in issues a server-side session in an HttpOnly cookie. No page trusts an email address on its own to act for an account.
• Payment is handled entirely by the payment provider; card details never reach this site, and subscription changes are verified by signed webhook.

Reporting a vulnerability

If you find a weakness, report it privately through the contact page before sharing it anywhere. Include enough to reproduce it. Good-faith research that avoids touching other people's data, avoids degrading the service, and gives us a reasonable chance to fix the issue is welcome, and you will not be pursued for it.

Out of scope

Volumetric denial-of-service, social engineering of staff, and reports from automated scanners with no demonstrated impact are not in scope.