Report a vulnerability
Email [[to confirm: support email — domain not chosen]]. Please give us 90 days before public disclosure. We don't pursue good-faith researchers.
What we do
Passwords hashed with PBKDF2 (200,000 rounds), session cookies HttpOnly + SameSite, files served only to their owner unless published.