Security

Credentials are encrypted at rest (AES-256-GCM), payment webhooks are signature-verified, and sessions are server-side. A full security overview and disclosure policy will be published here.

To report a vulnerability: report it here or open a support ticket — we respond fast.