Security
How this platform is built to fail safely.
How to report a vulnerability, and what this service does to protect accounts and credentials.
Reporting a vulnerability
No security contact is configured on this deployment yet.
Good faith research
We will not pursue legal action over security research carried out in good faith against our own systems, provided you stay within the scope below, do not access or retain other people's data, and give us a chance to respond before disclosure. If you are unsure whether something is in scope, ask first.
Out of scope
- · denial of service, load testing, or anything that degrades the service
- · social engineering of staff, customers or partners
- · the proxy network itself, which is out of scope for this programme
- · missing hardening headers with no demonstrated impact
- · reports produced solely by an automated scanner, with no working proof
How the service is built
- Passwords
- Hashed with argon2id. They are never stored or logged in a recoverable form, and support will never ask you for one.
- Proxy credentials and API keys
- Encrypted at rest with AES-256-GCM under a key held outside the database, so a database dump on its own does not reveal them.
- Request integrity
- API requests carry an HMAC-SHA256 signature over the method, path, query, body digest, timestamp and a single use nonce. Replayed nonces are rejected.
- Sessions
- Held in HttpOnly, SameSite cookies that JavaScript cannot read, and cleared server side on sign out.
- Abuse controls
- Per IP rate limits, a Cloudflare Turnstile challenge, and a proof of work check on sign in and registration that costs a bot CPU time whether or not the credentials are valid.
- Transport
- HTTPS only, with HSTS, a restrictive Content-Security-Policy, nosniff and framing denied.
No independent audit
this service has not been through a third party security audit or penetration test. The measures above describe how it is built, not a certification. Judge it accordingly.