Credential protection
Secrets stay in protected server environments, are never committed to source code, and are exposed only to the narrow server-side process that requires them.
Security
Controls that protect systems and customers
Security is part of requirements, implementation, deployment, and operation. Controls are selected according to the data, access level, and impact of each system.
Core practices
Access control
Administrative routes require authenticated authorization. Private operational modules are isolated from public and tenant-facing interfaces.
Encrypted transport
Public applications and supported mail submission use current TLS certificates. Certificate health and renewal are monitored.
Controlled changes
High-impact operations use previews, explicit confirmation, bounded input, idempotency, and audit records.
Event integrity
Supported provider webhooks use signature verification and deterministic deduplication before state changes are accepted.
Data minimization
Logs and records retain the operational evidence needed for support without storing message bodies, raw credentials, or unnecessary private payloads.
Report a vulnerability
Email waconzy@live.com with the affected URL, a clear description, reproduction steps, and potential impact. Do not access data that is not yours, disrupt service, use destructive testing, or publish the issue before remediation is coordinated.
We acknowledge legitimate reports and prioritize them based on demonstrated impact. This reporting channel does not authorize testing outside those boundaries.
Operational incidents
For suspected account compromise, abusive email, or service misuse, use the same address with the subject “Urgent security or abuse report.” Include timestamps, sender or hostname, and relevant headers where available. Do not include passwords or private keys.
Last updated: August 6, 2026