Security and responsible disclosure policy

Last updated: 2026-11-12

How we protect the site

• All pages are served over encrypted connections (HTTPS).
• Passwords are stored as Argon2id hashes. Session tokens are stored only as hashes.
• Two-factor sign-in is available to every account and required for administrators. Sensitive administrative actions require the password again.
• Keys for connected services are stored encrypted. Card details are handled only by our payment providers.
• Sign-in, registration and other forms are rate-limited, and repeated failed sign-ins lock an account temporarily.
• Uploaded files are checked by content, stored outside the public website and never run by the server.
• Administrative actions are recorded in an audit log.

No system is perfectly secure. If you find a weakness, please tell us.

Reporting a vulnerability

Send a description through the contact form or to the address on our Contact page, with "Security" in the subject. Please include:

• the affected page or feature;
• steps to reproduce the issue, and what an attacker could do;
• your contact details, if you would like us to follow up.

We will acknowledge your report, keep you informed where we can, and tell you when the issue is fixed.

Please

• Test only with your own account and data, and stop as soon as you have confirmed a problem.
• Do not access, change or delete other people's data.
• Do not run denial-of-service tests, spam, social engineering or physical attacks.
• Do not use automated scanners that send large volumes of requests.
• Give us reasonable time to fix the issue before telling anyone else.

Our commitment

If you follow this policy in good faith, we will not take legal action against you for your research, and we will work with you to understand and fix the issue. We do not currently run a paid bug bounty programme.

Contact

Use the contact form on the Contact page.