Security

How we protect the site

• All traffic uses HTTPS.
• A strict Content Security Policy and other security headers limit what pages are allowed to load and run.
• No third-party scripts are loaded.
• Server-side processing, when introduced, will run in isolated workers with strict limits and automatic deletion of files.

No website can promise complete protection against every attack. We have not yet had an independent security test, and we will update this page when we do.

Reporting a vulnerability

If you believe you have found a security problem, please contact a contact address that will be published here before launch. Please do not access other people’s data, disrupt the service or run automated scans that generate heavy traffic.