Security and Vulnerability Disclosure

Last updated: November 11, 2026

How we protect data

• Encrypted connections (HTTPS) on every page.
• Passwordless sign-in by one-time email links; session tokens are stored hashed.
• Bot protection and rate limits on sign-in, forms and messages.
• Role-based access for staff with an audit log of every moderation action.
• Daily database backups and error monitoring.

Reporting a vulnerability

If you believe you found a security issue, email info.gorvado@gmail.com with the subject "Security". Include the steps to reproduce, the affected page and the impact. We confirm receipt within 3 business days and keep you updated.

Safe harbor

We will not pursue legal action against good-faith research that:

• avoids privacy violations, data destruction and service disruption;
• only uses accounts you own or have permission to test;
• does not access more data than needed to show the issue, and deletes any data obtained;
• gives us reasonable time to fix the issue before any disclosure.

Out of scope: denial-of-service, spam, social engineering of staff or users, physical attacks, and reports from automated scanners without a working proof of concept. We do not run a paid bug bounty at this time.