Security

How we protect Foundaree

• All traffic uses HTTPS.
• Passwords are stored only as salted scrypt hashes; session tokens are stored only as SHA-256 hashes.
• Sign-in uses an HttpOnly cookie that page scripts cannot read. Sessions expire after 24 hours and are revoked when you sign out.
• Google and GitHub sign-in uses the OAuth authorization-code flow with a one-time state value and PKCE. We only accept verified email addresses, and we never merge a new sign-in into an existing password account automatically.
• Private and unlisted profiles are filtered on the server and never appear in search, sitemaps or AI interfaces.
• The API checks every input, limits request rates, allows only our own website to make signed-in requests and sends strict security headers.

Keeping your account safe

• Use a unique password, or sign in with Google or GitHub with two-factor authentication turned on.
• Foundaree will never ask for your password by message or email.
• Be careful with links and requests for money or documents; see the community guidelines.
• Sign out on shared devices.

Report a vulnerability

If you think you've found a security problem, email hello@foundaree.com. Please include the affected page or API, steps to reproduce and the impact you expect.

We ask that you:

• give us reasonable time to fix the issue before sharing it publicly;
• only test against your own accounts and data, and stop if you reach anyone else's;
• avoid degrading the service: no denial-of-service, spam or social engineering.

We will acknowledge your report, keep you updated and credit you if you wish. We won't take legal action against good-faith research that follows these rules.