Security

Report a problem

Email [email protected] with “Security” in the subject.

Tell us what you found, how to reproduce it, and what it lets someone do. Screenshots or a short script help.

In return we will:

• tell you we have it, and keep you posted until it's fixed;
• fix it as fast as we can, the worst problems first;
• thank you by name on this page once it's fixed, if you'd like that.

We're a small show, so there's no paid bug bounty: the thanks is our gratitude and the credit.

Research in good faith

We won't pursue legal action against anyone who looks for problems in good faith and:

• only reaches other people's data as far as it takes to show the problem, and keeps none of it;
• doesn't slow the show down or break it for others (no load tests or denial of service);
• doesn't trick our people or our users (no phishing or social engineering), and sends no spam;
• gives us a reasonable time to fix it before telling anyone else.

Out of scope: the services we use (Stripe, Google, Cloudflare, DigitalOcean and the others on How it's built: report to them), and scanner output without a problem shown.

How we protect the show

• Every page and call is served over HTTPS, browsers are told to use it every time (HSTS), and no other site can put the show in a frame.
• You pay on Stripe's own page: card details never reach us.
• Passwords are stored only as salted scrypt hashes, never as the password itself.
• Your sign-in lives in a signed cookie that the page's scripts can't read (HttpOnly, SameSite).
• Password sign-in pauses for 15 minutes after 10 wrong passwords, so nobody can guess their way into an account.
• A forgotten password is reset with a link sent to the account's recovery email. The link lasts an hour and works once, and the owner gets an email whenever the password or that address changes.
• The model keys people bring are encrypted (AES-256-GCM) before they're stored.
• The admin tools need a signed-in admin account.
• Every change runs the test suite and a scan for leaked secrets before it ships.
• The servers and the database are in the United States.
• The site is checked from outside every 5 minutes, and the results are public on the status page, which stays up when the site doesn't.

What we store and why is in the privacy notice. The machine-readable version of this page is at /.well-known/security.txt.