Security practices
We use access controls, encrypted network transport, managed infrastructure, environment-based secret storage, request validation, rate limiting, and monitoring appropriate to the service. Access to production systems and personal data is limited to people and providers who need it. We review dependencies and investigate reported vulnerabilities.
No system is perfectly secure. This page does not claim a certification, audit, penetration test, or compliance attestation that has not been completed.
Report a vulnerability
Email vilgot@moeschlin.com with a clear description, affected URL or component, reproduction steps, impact, and any supporting evidence. Encrypt sensitive reports using mailto:vilgot@moeschlin.com. Do not include personal data you do not need to demonstrate the issue.
Responsible research
Use only accounts and data you own or have permission to test. Stop if you access another person's data. Do not perform denial-of-service testing, social engineering, spam, destructive testing, automated high-volume scanning, physical attacks, or actions that degrade the service. Do not publicly disclose an unresolved issue before we have had a reasonable opportunity to investigate and fix it.
What to expect
We aim to acknowledge valid reports within 7 business days, provide status updates when practical, and prioritise fixes by risk. We do not currently operate a bug bounty and cannot promise payment. Good-faith research that follows this policy will not be intentionally pursued by us, but we cannot authorise testing of third-party systems or bind law-enforcement or other parties.
Account or abuse issues
For compromised accounts contact vilgot@moeschlin.com. For phishing, unlawful content, or misuse of a published site contact vilgot@moeschlin.com. Security reports sent through public support channels may be delayed.