Security

Pragmatic security.
Boring is the goal.

This page describes our security posture at a high level. If you believe you have found a security issue, please report it responsibly.

Secure-by-default headers

We ship common web security headers and a conservative indexing posture for sensitive routes.

The site includes authenticated flows and role concepts, with a bias toward least privilege and explicit access control.

Public form inputs are validated and basic rate limits are enforced to reduce abuse and noise.

We prioritize deploy safety, observability, and documentation so changes can be made calmly and predictably.

Responsible Disclosure

We will acknowledge reports as soon as practical and prioritize fixes based on severity and exploitability.