Current security boundaries
The application is designed to keep authorization and private data handling on the server, keep payment secrets out of browser code and public pages, validate user-owned records, and limit public pages to information deliberately selected for sharing. These are product safeguards, not a guarantee of zero risk, legal compliance, regulatory approval, or perfect availability.
What is not a security promise
Public or unlisted information can be copied by people who can access it. A verification badge does not prove identity, skill level, employment history, credentials, background, safety, or employer conduct. No online service can promise that every attack, outage, vendor failure, or user mistake will be prevented.
Responsible reporting
Use the security reporting form below to report a suspected security or privacy issue. Share the minimum detail needed to reproduce the issue and avoid sending secrets, passwords, raw identity documents, or live payment credentials. Do not publicly disclose an unremediated vulnerability or use the report to access information that is not yours.
Payments and webhooks
Paid access is intended to be granted from server-authoritative payment state. Webhook signatures, event age, duplicate-event handling, and auditable purchase outcomes are part of the payment boundary. If the production configuration has not been confirmed, checkout should say so and no charge should be represented as complete.