Security practices

Account protection

• Optional two-factor authentication with any authenticator app, turned on from your account page.
• Passwords are checked against known-breached password lists at sign-up and when changed, and are stored only as salted hashes by our auth provider.
• Sign out of all devices ends every active session immediately if a device is lost or shared.
• Email address changes require confirmation from the new address.

Data isolation

• Every user table enforces row-level security scoped to the signed-in account, so one account can never read or write another's rows.
• Billing fields (subscription status, Stripe identifiers) are writable only by our verified Stripe webhook — never from the browser.
• Stars, streaks and shop purchases go through server-side functions with caps and locking, so balances can't be forged from the client.
• Automated tests run in our CI pipeline on every change to prove these boundaries still hold.

Infrastructure

• All traffic is served over HTTPS/TLS.
• Payments run entirely inside Stripe Checkout and the Stripe billing portal; we never receive card details.
• Secrets and API keys are held in server-side secret storage and are never shipped to the browser.
• Dependencies are audited for known vulnerabilities in our CI pipeline.

Reporting a vulnerability

If you believe you've found a security issue, contact the app owner at the address listed on the site before disclosing it publicly. Please include steps to reproduce. We'll confirm receipt and keep you updated while we investigate.