Security & vulnerability disclosure
Last updated: November 2026
How we protect the service
- HTTPS only (HSTS preload), strict Content Security Policy, no third-party scripts except optional bot protection.
- Accounts and database protected by row-level security; secrets and service keys exist only on the server.
- Screened names are processed in memory and are never stored or logged; usage counters use account IDs or a daily-rotating, irreversible hash of the connection.
- Rate limits on every API, signed tickets between screening steps, protection against server-side request forgery in the web crawler, safe spreadsheet exports (formula injection neutralised).
- Separate development, test and production environments; automated security tests on every release; compressed backups of all public source data.
Report a vulnerability
Please email hasham.munir@afcnova.com with “Security” in the subject, or use the contact form. Give us reasonable time to fix the issue before disclosure, do not access other users' data, and do not run denial-of-service or automated scanning against production. We do not take legal action against good-faith research that follows these rules. Our security.txt follows RFC 9116.