Security

All traffic to and from the Service is encrypted in transit using TLS (HTTPS). Data at rest is stored on managed infrastructure, and application secrets and credentials are held in managed environment configuration rather than in source code.

Passwords are never stored in plain text, they are hashed with bcrypt. Sessions use short-lived JWT access tokens with rotating refresh tokens and reuse detection, delivered as secure, HttpOnly cookies so they can’t be read by client-side scripts. You can also sign in with Google. We recommend a strong, unique password and signing out of shared devices.

Authentication endpoints are rate limited per IP address, and repeated failed logins temporarily lock an account to slow credential-stuffing and brute-force attempts. Our crawler applies request controls and protections against server-side request forgery when fetching the URLs you submit.

Access to production systems is restricted to authorized personnel on a least-privilege basis and protected by strong authentication. Administrative functions in the product are gated behind role-based access controls.

Subscription and credit payments are handled by a PCI-compliant third-party payment processor. We do not receive or store full payment-card numbers on our systems.

We host on managed cloud infrastructure and rely on vetted third-party providers for data, AI, email and payments. See our Privacy Policy for how these providers process data on our behalf.

If you believe you have found a security vulnerability, please report it to [email protected] with enough detail to reproduce the issue. Please give us a reasonable opportunity to investigate and remediate before public disclosure. We investigate all legitimate reports and work to fix confirmed issues promptly.