YaadTag it.

Policy

Security

Built fast with AI-assisted development, then put behind conventional application-security controls. Not "unhackable" — no internet-facing app is — but this is what actually protects it today.

What's actually implemented

  • Server-side authorization on every request. Every read/write checks the signed-in caller's identity against the resource being accessed — never trusted from the client, never decided by hiding a button.
  • Row Level Security is enabled on every database table, with real public-read/owner-write policies on shared content and deny-by-default (service-role-only) policies on internal tables.
  • Rate limiting on authentication, publishing, and every endpoint that creates real infrastructure (Try, personal instances, redeploys) — keyed per account, not just per IP.
  • Outbound-request protection (SSRF guard) on every feature that fetches a user-influenced URL — blocks private/loopback/link-local and cloud metadata addresses, and re-validates every redirect hop.
  • Signed webhook verification (HMAC, constant-time comparison) on inbound GitHub webhooks — unsigned or invalid payloads are rejected before they're ever parsed.
  • Secrets stay server-side. Database service-role keys, provider API keys, and signing secrets are never sent to the browser.
  • Security headers and a Content-Security-Policy are set on every response, including HSTS, a nonce-based script policy, and restricted permissions for camera/microphone/geolocation.
  • Content moderation via a report flow and admin review for user-generated content (published software, sandbox notes, reviews).

What we haven't done yet

Stated honestly rather than implied — none of the following exist today:

  • No external, independent penetration test has been performed.
  • No SOC 2 or ISO 27001 certification.
  • No paid or open bug-bounty program.
  • No dedicated WAF beyond the hosting platform's own edge network protections.
  • No full automated SAST/DAST scanning pipeline (a minimal dependency and secret scan runs in CI).

These are a real post-launch roadmap, not a promise they're already covered.

Reporting a vulnerability

Found a real security issue? Email shamarwebsterrb@gmail.com with what you found and how to reproduce it. Please don't access, modify, or exfiltrate other users' data beyond what's necessary to demonstrate the issue, don't run denial-of-service testing, and give us a reasonable window to fix a confirmed issue before public disclosure. We'll acknowledge real reports as soon as we can.

Machine-readable version: /.well-known/security.txt.