trust
security
how we protect api keys, customer data and the service itself.
01api keys
random high-entropy keys, shown once; only a sha-256 hash is stored. keys can be revoked immediately.
02transport
https only with hsts. the database is not reachable from the internet.
03application
parameterised sql, input validation, content security policy and rate limiting.
04administration
the admin panel is password-protected and not indexed; keys are issued manually.
05report a vulnerability
email security@newsmetry.xyz. do not include secrets or personal data in the first message.