Trust
Security
How we protect the platform, and how to tell us if you find a problem.
Encrypted in transit
Every page and API call is served over HTTPS with HSTS.
Secrets kept out of code
API keys and database credentials live in encrypted environment variables, never in the repository.
Least access
Admin endpoints, such as reading contact messages, need a separate admin token.
Safe by default
Text from sources and the AI is escaped before it's shown, forms reject bots, and public checks are rate-limited by caching.
Reporting a vulnerability
If you believe you've found a security issue, please contact us, choose "Something else" and start your message with "Security". Include steps to reproduce it. Please give us reasonable time to fix it before disclosing it publicly, and don't access or change other people's data while testing.