How we protect you
- Encryption in transit: the whole site is served over HTTPS with HSTS.
- Passwords: stored only as scrypt hashes with a unique salt. We check new passwords against known breached passwords using a privacy-preserving lookup that never sends your password anywhere.
- Sessions: random tokens in secure, HttpOnly cookies. We store only a hash of each token, so a database leak wouldn’t expose live sessions. You can see and end your sessions from your account.
- Two-step verification: available to every member with any authenticator app, with one-time recovery codes. Required for all staff accounts.
- Payments: handled entirely by Stripe. Card details never touch our servers.
- Web protections: a strict Content Security Policy, protection against cross-site request forgery, rate limits and progressive lockouts on login and other sensitive actions.
- Least privilege: staff access is limited by role, and every staff action on member data is recorded in an audit log.
- Minimal software supply chain: our server runs with no third-party runtime packages, which shrinks the code we have to trust.
- Backups: encrypted and tested regularly.
Keeping your account safe
- Use a password you don’t use anywhere else. A password manager makes this easy.
- Turn on two-step verification in Account → Security.
- We will never ask for your password or a verification code by email, phone or message.
- If you get an email that looks like us but feels off, don’t click the links. Go to the site directly or forward it to us.
Reporting a vulnerability
Email [security email] with:
- a description of the issue and its potential impact;
- step-by-step instructions to reproduce it, including URLs, requests and test accounts used;
- any proof-of-concept code or screenshots;
- how you’d like to be credited, if at all.
Our security.txt file lists the same contact details.
Scope
In scope: [yourdomain.com] and its subdomains, including the member account area, the back office and the API at /api/.
Out of scope:
- denial-of-service, load or volume testing;
- social engineering, phishing or physical attacks on our staff, partners or premises;
- third-party services we use, such as Stripe, our email provider or USPS (report those to the vendor);
- findings from automated scanners without a demonstrated impact, missing best-practice headers without an exploit, self-XSS, clickjacking on pages with no sensitive actions, and email spoofing reports without proof of a missing SPF, DKIM or DMARC record.
Rules of engagement
- Only test against accounts you own or have explicit permission to use.
- Access the minimum data needed to show the problem. If you reach other people’s personal information, stop, don’t keep it, and tell us immediately.
- Don’t modify or delete data, disrupt the service, or degrade it for other members.
- Don’t place real orders with stolen or test card numbers.
- Give us a reasonable time to fix the issue before telling anyone else about it. We suggest 90 days, and we’re happy to agree a date with you.
Safe harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not pursue or support legal action against you, and if a third party takes legal action against you over research done under this policy, we will make it known that your actions were authorised. If you’re unsure whether something is allowed, ask us first.
What to expect from us
- We’ll acknowledge your report within 3 business days.
- We’ll give you an initial assessment within 10 business days and keep you updated until it’s fixed.
- We’ll credit you publicly, if you want, once the issue is resolved.
- We don’t run a paid bug bounty yet, but we do send a thank-you box of books.