Security

1. Reporting a vulnerability

Email devtmj@apeironlabs.tech with the subject line SECURITY. Include what you found, steps to reproduce it and the impact you expect. Please do not open a public issue or post details in the community forum. Our contact details are also published in machine-readable form at /.well-known/security.txt.

2. What we commit to

• We aim to acknowledge reports within 3 working days and keep you updated until the issue is fixed.
• We are happy to credit reporters who wish to be named once a fix is out.
• We do not currently run a paid bug bounty.

3. Please

• Give us reasonable time to fix an issue before disclosing it.
• Test only against your own account. Do not access or modify other people's data.
• Do not degrade the service, send spam, or run automated scans that generate significant traffic.
• Do not use social engineering or physical attacks.

4. Scope

This website and its backend, including any custom domain pointing at it. MythBrowse and MythDesk are developed separately; report issues in them to the same address and say which product is affected.

5. How the site is protected

• No passwords. Sign-in uses GitHub or one-time email links. Sessions are stored server-side so you can review and revoke them, and cookies are HTTP-only and Secure.
• Two-factor authentication is available to every account and required for administrators. Authenticator secrets are encrypted (AES-256-GCM); recovery codes are stored only as hashes.
• Least privilege. Roles are enforced on the server for every action, and every moderator and admin action is written to an audit log.
• Hardened responses. A strict, nonce-based Content Security Policy, HSTS, and protections against framing, MIME sniffing and cross-site request forgery.
• Safe content. All input is validated, database queries are parameterised, and community markdown is sanitised with raw HTML and images removed.
• Abuse controls. Rate limits, bot protection and honeypot fields on public forms. IP addresses are stored only as salted hashes.
• Supply chain. Automated dependency updates and a dependency audit, lint, type check and build on every change.

6. If something goes wrong

If a security incident affects your personal data, we will notify affected people and the relevant authorities as required by applicable law. See the Privacy Policy for how data is handled.