Security
Reporting a vulnerability
Email security@mundaneread.com. We acknowledge within two business days, keep you informed, and do not take action against good-faith research that avoids privacy violations, data destruction and service disruption. Our security.txt is published.
Accounts
- No passwords. Each sign-in is a six-digit code sent by email, valid once, for ten minutes, for five tries. Only a keyed hash of the code is stored.
- Sessions are signed, HttpOnly, Secure and SameSite=Lax cookies.
- Sign-in and code requests are rate-limited per address and per network.
API keys and extension tokens
Stored only as SHA-256 hashes. A key is shown once and cannot be recovered, by you or by us.
Payments
Handled entirely by Stripe. We never receive or store card numbers. Webhooks are verified by signature.
Infrastructure
- Runs on Cloudflare Workers with a Cloudflare D1 database. Traffic is HTTPS only (HSTS).
- Pages send a Content Security Policy that forbids third-party scripts and framing.
- No third-party analytics or advertising scripts.
Sub-processors
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting, database, email routing |
| Stripe | Payments and billing |
| Resend | Sign-in and account email |