How we protect the site

Security

This is a small, self-hosted service. Security is a release gate, not a marketing claim. Here is the short version of the design.

Accounts

Passkeys are the primary login. A recovery key is a 256-bit browser-generated secret; the server stores only a one-way fingerprint. Sessions are random, hashed at rest, host-only, HttpOnly, Secure, and SameSite=Strict. State-changing requests use a CSRF token, an exact Origin check, and Fetch Metadata checks. Login and recovery-key attempts are rate-limited.

Privacy boundaries

The friend graph is enforced in server-side queries. A post is visible only to its author and accepted friends, and only when its audience allows it. There is no public user directory. Chat rooms are created only for accepted friendships, and a Synapse module rejects invites and room creation outside the graph. Federation is disabled.

Encryption

Chat is end-to-end encrypted with Matrix Megolm. The server stores ciphertext and metadata. Version and configuration pinning, authenticated media, and a strict Content Security Policy help contain client-side attacks. The operator does not have a backdoor to chat contents.

Images

The only accepted upload is a profile image. Files are decoded, pixel-capped, re-encoded to WebP, stripped of EXIF/GPS, given random names, stored outside the web root, and served through an authorised route with nosniff. SVG and all other file types are rejected. Post, video, and chat attachments are disabled.

Operations

HTTPS only, strict headers, internal-only database and admin APIs, encrypted backups, short log retention, dependency and container scanning, and a documented incident response. Admin access uses a separate short-lived staff session and is restricted at the proxy to the operator's private network.

Reporting a vulnerability

Email abuse@shopdigital.art with steps to reproduce and the account or URL involved. Do not access another person's data, disrupt the service, or test against real users. Good-faith research is welcome; the operator will not pursue a report made in good faith.

What we cannot promise

No internet service is perfectly secure. A compromised device, a stolen recovery key, a vulnerable browser, or a server compromise can expose data. End-to-end encryption protects message contents from the server, not from a compromised endpoint. Back up your recovery key and keep your devices updated.