● Run · Protection

Security
how your data and the internet are protected.

In plain words: your keys are stored encrypted, every change is logged with a name, the console refuses requests from other sites, and the website check cannot be pointed at your own server or private network. This page lists what is in the code and what remains your job.

Encrypted keysAudit logPrivate addresses refused

01Keys and passwords

Keys saved in the console are encrypted with ADMIN_SECRET_KEY and are write-only: the console never shows them again, and a connection test never echoes them.
Passwords are stored as scrypt hashes with a salt per user. Sign-in sessions use a cookie that scripts cannot read and that is not sent by other sites (HttpOnly, SameSite=Strict, Secure over https).
Five failed attempts within 15 minutes pause sign-in, setup or two-factor attempts for that account (setup: for everyone) until the 15 minutes are over.
Two-factor sign-in with an authenticator app, and a rule that requires it for owners and managers (Security & alerts).

02The console

Every change needs a signed-in role high enough for it (Team and roles), a special request header and a same-site origin, so a page on another site cannot make your browser change anything.
Every change, export and key test is written to the audit log.
Pages are served with a strict Content Security Policy: scripts, styles and fonts only from your own server, no embedding by other sites.

03The website check

Anyone on your team can type a web address on a lead, so the check must not be usable to reach places it should not. It asks only public https addresses on the standard port, resolves the name and refuses every private, local or reserved IP address (IPv4 and IPv6), checks again on every redirect (at most three), and stops reading after 2 MB or 10 seconds. A site that redirects from https to http is not read.

04Public pages

Report pages use a random 24-character link and tell search engines not to index them; at most 120 per minute per visitor.
Unsubscribe links are signed, change nothing on a plain visit, and allow 60 uses per 10 minutes per visitor.
Set TRUST_PROXY correctly so these limits see real visitors (details).

05Your part

Create the owner before the server is reachable (why).
Keep the server updated, open only ssh, 80 and 443.
Back up data/ and .env and keep the backups private.
Give each person the smallest role, and turn on two-factor.
Never send keys, passwords or .env to anyone, including support.