Security
Security.
Practical notes on how this site is run, what we protect, and how to report issues.
Transport and storage
Public traffic is served over HTTPS with HSTS at the edge. Account sessions use httpOnly cookies. Application data lives in SQLite on the production host with regular backups; object assets (icons, screenshots) are stored in R2 with signed access where needed.
Access controls
Signed-in account surfaces require a valid session. Console and privileged APIs use separate console sessions or bearer secrets. Public APIs that expose bulk data use API keys where applicable.
Operational status
Live component signals are published on /status. Machine-readable health is available at /api/health.
Vulnerability disclosure
If you find a security issue in Tech Dev Notes, please report it privately before public disclosure. Contact @techdevnotes with a clear description, affected URL or API route, and steps to reproduce. Do not access other users' data or disrupt production services while testing.
Privacy
For what we collect and why, see the Privacy Policy.