Security & Vulnerability Disclosure
Version 24 July 2026 · effective and last updated 24 July 2026 · last reviewed 1 August 2026
How we protect your data (summary)
We take a practical, defence-in-depth approach:Authentication. Sign-in is handled by Clerk, a specialist identity provider; we don't store your password.Authorisation. Access to privileged data and admin functions is enforced on the server against a cryptographically-verified identity — never a value supplied by the browser. Admin routes are gated in middleware and again server-side.Payments. Card data is handled directly by Stripe and never reaches or is stored on our systems. Payment webhooks are verified against the raw request signature.In transit. Traffic is served over encrypted connections (TLS/HTTPS).Least privilege & audit. Administrative access is limited on a need-to-know basis, and every administrative action is written to an append-only audit log.Data minimisation. We collect only what we need and retain it only as long as needed (see the Privacy Policy).Providers. We rely on established providers — Clerk, Convex, Stripe, and Vercel — which operate their own security programmes.
Reporting a vulnerability
We welcome reports from security researchers and users acting in good faith. If you believe you've found a security vulnerability, please email [email protected] with “Security” in the subject line. Please include: what you found, the steps to reproduce it, the affected URL or feature, and its potential impact. A proof-of-concept helps us reproduce and fix it quickly.
Scope
In scope: this website and web application.Out of scope: the systems of our providers (Clerk, Convex, Stripe, Vercel) — please report those to the provider concerned; and findings that require social engineering, physical access, denial-of-service / volumetric testing, or spam. Please do not run automated scanners that degrade the service.
Safe harbour
If you make a good-faith effort to comply with this policy during your research, we will regard it as authorised, will work with you to understand and resolve the issue promptly, and will not pursue or support legal action against you. In return, please: act in good faith; avoid privacy violations, data destruction, and service disruption; only interact with accounts you own or have explicit permission to access; stop as soon as you've confirmed a vulnerability; and never access, modify, or retain data that isn't yours.
What to expect
We aim to acknowledge your report within 5 working days, keep you reasonably informed of progress, and let you know when the issue is resolved. With your permission, we're happy to credit you once a fix is released. We don't currently run a paid bug-bounty programme, so reports are made on a voluntary basis.
Independent assessment
We are committed to commissioning an independent penetration test and security assessment. When completed, a summary will be published here. In the meantime, our established providers — Clerk, Convex, Stripe, and Vercel — each operate their own security programmes.
Secure reporting and service status
For sensitive vulnerability reports, email us and mark it confidential — we'll agree a more secure channel with you directly. We do not currently publish a PGP key; if that changes, it will be noted here.
Coordinated disclosure
Please give us a reasonable opportunity to investigate and fix an issue before disclosing it publicly, so that users aren't put at risk. We're grateful for reports that are shared privately first.
A machine-readable version is published at /.well-known/security.txt (RFC 9116).