Security & Responsible Disclosure
Not legal advice. These pages are product scaffolding so CONTINUUM can meet a basic trust standard and protect the operator from accidental promissory language. They are not a substitute for a licensed attorney, bar-approved forms, or regulatory approval. The operator must confirm governing law, licenses, and counsel review before enabling paid SYN.
Security at epistles.xyz
The site operator takes reasonable measures to protect the website and user data. No system is perfectly secure. This page describes our approach and how to report concerns.
What we do
- Passwords are stored as salted hashes, never in readable form
- Sessions use secure, HTTP-only cookies
- Rate limiting protects authentication and sensitive endpoints
- Security headers (CSP, HSTS, and others) are applied to responses
- Secrets and credentials are redacted from any diagnostic or inspection output
What we ask of you
- Use a unique, strong password for your account
- Do not share your credentials or session tokens
- Do not attempt to access other users' accounts, private data, or restricted systems
- Do not probe, scan, or test the site's security without prior written authorization
Responsible disclosure
If you discover a security vulnerability, we ask that you:
- Do not exploit it. Do not access, modify, or exfiltrate data beyond what is needed to confirm the issue.
- Report it privately via Legal & Contact with a clear description, steps to reproduce, and the potential impact.
- Allow time to respond before any public disclosure. We aim to acknowledge reports within 7 days.
- Do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it.
We will not pursue legal action against researchers who follow these guidelines in good faith.
What we will not disclose
We do not publicly reveal internal security architecture, credentials, private repository contents, or details of unpatched vulnerabilities. Security through obscurity is not our strategy — but neither is publishing a roadmap for attackers.