Security

Last updated: 25 October 2026

How we protect you

• Encryption in transit: every page and API call uses HTTPS, with HSTS enforced.
• Passwordless by default: sign-in links work once, expire after 15 minutes, and are stored only as one-way hashes. Optional passwords are hashed with scrypt.
• Hardened sessions: session cookies are HttpOnly, Secure and host-only, and stored on our side only as hashes.
• Abuse protection: rate limits on sign-in and account actions, and a strict Content Security Policy on every page.
• Least privilege: each part of the system can reach only the data it needs, and secrets live in a managed secrets store.
• Backups: point-in-time recovery for our database, plus daily copies to a separate provider that can't be deleted early.

Reporting a vulnerability

If you believe you've found a security issue in Chezalab, please email support@chezalab.store with the subject "Security report". Include:

• a description of the issue and its impact;
• steps to reproduce it, or a proof of concept;
• the URLs or endpoints involved.

We'll acknowledge your report within 3 business days and keep you updated until it's resolved.

Guidelines

We won't take legal action against you for good-faith research that follows these rules:

• Only test against your own accounts, and never access, change or delete other people's data.
• Don't run denial-of-service attacks, spam, or social engineering or phishing against our team or users.
• Don't use automated scanners that send high volumes of traffic.
• Give us reasonable time to fix the issue before telling anyone else about it.

In scope: chezalab.store and www.chezalab.store, including /api/. Out of scope: our third-party providers' own systems (report those to the provider), and findings that need physical access to a user's device.

A machine-readable version of this policy is at /.well-known/security.txt.