How accounts are protected, and how to report a problem

What we do

• Passwords are hashed with scrypt and never stored in the clear.
• Sessions use a __Host- cookie that is Secure, HttpOnly and SameSite=Lax.
• State-changing requests made with the session cookie require a CSRF token.
• Pages send a strict Content-Security-Policy with no inline scripts, plus nosniff and a referrer policy.
• Uploads are checked against the file signature, not the file name, and stored under opaque identifiers.
• Sign-ins, registrations and the contact form are rate limited.

What we do not claim

No security certifications, no audit badge. This is a small service and we say so. If that matters for your use, factor it in.