Security
The safest page is one that runs no code when a reader opens it. Published stories are static files; the control panel is protected separately.
Delivery
- Readers receive pre-built pages from the edge servers. No application code or database query runs for a published article.
- Strict content security policy on every public page. The platform adds no third-party scripts; if a publisher switches on AdSense or Google Analytics, exactly that one script is allowed and nothing else can run.
- Unknown hosts are refused; one canonical address per page.
Accounts and tenants
- Every query is scoped to the publisher and site; access is re-checked on the server for each action, not taken from the browser.
- Passwords are hashed with Argon2id; sign-in is rate limited; sessions expire and can be revoked.
- Forms are protected against cross-site request forgery.
- Important actions are written to an audit log.
Uploads and imports
- Files are quarantined and malware-scanned before use, re-encoded, and served from a separate, sandboxed path.
- Remote files (media imports, WordPress attachments) are fetched through a hardened downloader that refuses private networks.
- WordPress exports are read with external entities disabled.
We have not completed an external penetration test yet. Please report vulnerabilities through the contact form (topic “support”).