How accounts are protected

What we do

• Passwords hashed with scrypt, never stored in the clear.
• Sessions use a __Host- cookie that is Secure, HttpOnly and SameSite=Lax.
• Cookie-session writes require a CSRF token; token calls do not.
• A strict Content-Security-Policy with no inline scripts, plus nosniff and a referrer policy.
• Uploads checked against the file signature, not the name, and stored under opaque identifiers.
• Rate limits on sign-ins, registrations and the contact form.

What we do not claim

No security certifications, no audit badge. This is a small service and we say so. Our past issues, all fixed, are on the advisories page.

Report a vulnerability

Use the form with “security” in the subject. Tell us what you found and how to reproduce it. We read reports within a few working days and will not pursue good-faith research.

Machine-readable: /.well-known/security.txt