Security and responsible disclosure
How we protect webatla, and how to report a vulnerability if you find one.
How we protect your data
Defence in depth across transport, authentication, payments and access.
Encrypted transport
HTTPS everywhere with HSTS, behind Cloudflare with WAF and DDoS protection. The origin is locked to Cloudflare.
Strong authentication
Passwords are hashed with bcrypt, with optional two-factor authentication (TOTP). The TOTP secret is encrypted at rest.
We never store card data
Card payments are processed by Stripe (PCI-DSS). Crypto payments are handled by PayerURL.
Hardened by default
Strict Content-Security-Policy with per-request nonces, same-origin CSRF protection and rate limiting on sensitive endpoints.
Least-privilege secrets
Secrets live in the environment, never in code, with least-privilege access.
Reviewed regularly
We run regular security reviews and act on every responsible-disclosure report.
Reporting a vulnerability
We welcome reports from the security community. Email steps to reproduce, affected URLs and any proof of concept.
Acknowledged fast
We aim to acknowledge reports within three business days.
Kept in the loop
We keep you updated through remediation until the issue is resolved.
Coordinated disclosure
Please give us a reasonable window to fix the issue before any public disclosure.
Scope
What is covered by this policy, and what is not.
In scope
webatla.com- The public API under
/api - Our origin infrastructure
Out of scope
- Volumetric DoS and DDoS
- Social engineering and physical attacks
- Third-party services we use (Cloudflare, Stripe, Brevo, Tawk.to)
- Automated scanner output with no working proof of concept
Safe harbor
We will not pursue or support legal action against researchers acting in good faith who follow this policy, avoid privacy violations and service disruption, and do not access or modify data that is not their own.
Machine-readable contact details are published per RFC 9116 at /.well-known/security.txt.