Security

Security, stated plainly

We handle your ideas, files and business processes. This page says plainly how we protect them. Only things that are actually in place are listed.

Accounts and sign-in

  • Passwords are hashed with scrypt, a memory-hard algorithm; we never store or see your password
  • Passwords are checked for length, common choices and personal information
  • Optional two-factor sign-in with an authenticator app, and one-time recovery codes. Required for every team account
  • Repeated failed sign-ins are throttled and temporarily locked
  • You can see every device signed in to your account and sign out of any of them
  • Changing your password signs out your other devices

Your data

  • Strict access control: a request, message or file can only be opened by its owner and the MadeBy team. Anyone else gets the same “not found” as for something that does not exist
  • Internal team notes are never sent to your browser
  • All traffic is encrypted in transit (HTTPS) with HSTS
  • Uploaded files are validated by real content, not just file name, stored outside the web server and served as downloads only
  • You can export all your data or delete your account yourself from settings

The application

  • Strict Content-Security-Policy: no inline scripts, no third-party scripts, no external fonts or trackers
  • Every form is protected against cross-site request forgery
  • All database access uses bound parameters; all output is escaped
  • Session cookies are HttpOnly, Secure and SameSite, using the __Host- prefix
  • Rate limiting on sign-in, sign-up, contact forms and general traffic
  • Minimal dependencies: the server uses almost no third-party code, which shrinks the attack surface and supply-chain risk

Operations

  • Security-relevant actions are written to an audit log
  • Secrets live in server configuration, never in the code
  • Errors never reveal internals to visitors
  • Automated tests cover access control, authentication and input handling

Found something? Tell us.

If you believe you have found a security issue, please report it through the contact form with the topic “Security”, with enough detail to reproduce it. Please do not access other people’s data or disrupt the service while testing. We will acknowledge your report promptly and keep you informed. Machine-readable contact details are at /.well-known/security.txt.

Send message