Security

Email [email protected] with “Security” in the subject. Please include enough detail to reproduce the issue: the endpoint or page, the steps, and what you observed.

What you can expect from us:

• An acknowledgement within 3 business days.
• An assessment and a plan within 10 business days.
• Credit in our release notes if you would like it.

What we ask of you:

• Give us reasonable time to fix the issue before disclosing it publicly.
• Do not access, modify, or delete data that is not yours, and stop as soon as you have proof of the issue.
• Do not run denial-of-service tests, spam, or social engineering against us, our customers, or our providers.

We do not currently run a paid bug bounty, but we will not pursue legal action against researchers who follow this policy in good faith.

• Passwords are hashed with Argon2id — we cannot read them, and they are never logged.
• API keys are stored only as HMAC-SHA256 hashes with a server-side secret, so a database copy alone cannot be used to forge or verify keys.
• Optional two-factor authentication (TOTP) with single-use recovery codes; the authenticator secret is encrypted at rest.
• Short-lived access tokens with rotating refresh tokens, and a session list you can review and revoke device by device.
• A security audit log records sign-ins, key creation and revocation, and password changes.

• HTTPS everywhere, with the origin behind a network provider that absorbs volumetric attacks.
• Multi-signal rate limiting on keyless traffic, plus per-key quotas, so a single caller cannot degrade the service for others.
• An abuse blocklist that can shut down a specific address, network, or autonomous system quickly.
• Dependencies are audited on every build, and a build fails if a known-vulnerable package is present.
• Database migrations and deployments are automated and repeatable, so patches ship quickly.

We do not store the IP addresses submitted for lookup, we set no tracking cookies, and we do not sell personal information. Full detail is in the Privacy Policy, including retention periods and our breach-notification obligations under the Australian Notifiable Data Breaches scheme.

Our security contact is also published at /.well-known/security.txt in the format described by RFC 9116.