Security

How the service is built

• Every plugin update is signed (Ed25519) and verified by each site before it is installed; a tampered update is refused.
• The threat database is signed too, and checked on every site before use.
• Sites connect out to the dashboard with a per-site secret; the dashboard never holds WordPress passwords.
• Two-step sign-in for every dashboard user, short sessions, and re-confirmation for sensitive actions.
• Site secrets are encrypted with their own key; the audit log is append-only and hash-chained.
• Strict security headers and a content security policy on the dashboard.

Report a vulnerability

Write to [email protected] with what you found, how to reproduce it and its impact. We answer within three business days, keep you informed, and credit you if you wish.

• Test only against your own sites and accounts; do not access other people’s data, degrade the service or use social engineering.
• Give us reasonable time to fix the issue before telling anyone else.

Safe harbour

If you follow these rules in good faith, we will not pursue legal action against you for your research.