Report it, and we will publish it.
The findings register on this site holds every defect found in our own work, including three working server-side request forgery exploits against our first URL guard. A report from you goes in the same register, with credit, whether or not it flatters us.
Email security@worldauth.com. We acknowledge within two working days and aim to fix anything exploitable within fourteen. The machine-readable version is at /.well-known/security.txt.
In scope: this site, the hosted endpoint, the sandbox, the kit, and the local runner. Out of scope: our hosting and database providers’ own infrastructure, and any third-party site the endpoint can be pointed at — please do not test on those.
We do not run a bounty. We do publish, credit, and say thank you in writing.
- No service-role credential exists anywhere in the application. It holds a publishable key only; the tables are denied to it and every write goes through four validated functions.
- The URL guard resolves once, pins the connection to the address it decided on, re-vets every redirect, and reads against a byte budget on the decompressed stream.
- Rate limits exist per address and globally; refused requests are never charged to anyone.
- No external audit has been performed. Until a firm signs a report, the asterisk stays. The audit package is in the repository as AUDIT.md.
The full register is at /trust.