01. Hosting and network
CWAXX runs on Vercel, which serves every page over HTTPS from a global edge network and includes automatic DDoS mitigation. Sign-in, sign-up, one-time codes, image uploads and imports are rate-limited.
02. Passwords and accounts
Passwords are stored as salted bcrypt hashes, never in plain text. Accounts lock after repeated failed password attempts. Usernames are unique in the database, so two accounts can't claim the same one.
03. Sessions
Sessions use signed, time-limited tokens. Resetting your password or deleting your account signs you out on every device.
04. Uploads and links
Uploaded images are checked by their actual contents and re-processed, which removes metadata such as location. Links are checked before they're saved, so harmful link types (such as javascript: links) can't be added to a profile.
05. Reporting a vulnerability
If you find a security problem, please email security@cwaxx.com and give us a chance to fix it before sharing details. We won't take legal action against researchers who report problems this way in good faith.